Threat intelligence / Group

OilRig

[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.(Citation: FireEye APT34 Dec 2017)(Citation: Palo Alto OilRig April 2017)(Citation: ClearSky OilRig Jan 2017)(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Unit42 OilRig Playbook 2023)(Citation: Unit 42 QUADAGENT July 2018)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

109 recorded

Relationships

attributed-to

from Juicy Mix

Campaign

attributed-to

from Outer Space

Campaign

revoked-by

from APT34

Group

uses

to Asymmetric Cryptography

Technique

uses

to Automated Collection

Technique

uses

to BONDUPDATER

Malware

uses

to Brute Force

Technique

uses

to Cached Domain Credentials

Technique

uses

to certutil

Tool

uses

to Clipboard Data

Technique

uses

to Code Signing

Technique

uses

to Code Signing Certificates

Technique

uses

to Command and Scripting Interpreter

Technique

uses

to Compiled HTML File

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Credentials In Files

Technique

uses

to Data from Local System

Technique

uses

to Data from Removable Media

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DNS

Technique

uses

to Domain Account

Technique

uses

to Domain Accounts

Technique

uses

to Domain Groups

Technique

uses

to Domains

Technique

uses

to Email Accounts

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to External Remote Services

Technique

uses

to Fallback Channels

Technique

uses

to File Deletion

Technique

uses

to ftp

Tool

uses

to Helminth

Malware

uses

to Indicator Removal from Tools

Technique

uses

to Ingress Tool Transfer

Technique

uses

to ipconfig

Tool

uses

to ISMInjector

Malware

uses

to Keylogging

Technique

uses

to LaZagne

Tool

uses

to Local Account

Technique

uses

to Local Groups

Technique

uses

to LSA Secrets

Technique

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Malware

Technique

uses

to Mango

Malware

uses

to Masquerading

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mimikatz

Tool

uses

to Modify Registry

Technique

uses

to Net

Tool

uses

to netstat

Tool

uses

to Network Service Discovery

Technique

uses

to ngrok

Tool

uses

to ODAgent

Malware

uses

to OilBooster

Malware

uses

to OilCheck

Malware

uses

to OopsIE

Malware

uses

to Outlook Home Page

Technique

uses

to Password Filter DLL

Technique

uses

to Password Policy Discovery

Technique

uses

to Peripheral Device Discovery

Technique

uses

to PowerExchange

Malware

uses

to PowerShell

Technique

uses

to POWRUNER

Malware

uses

to Process Discovery

Technique

uses

to Protocol Tunneling

Technique

uses

to PsExec

Tool

uses

to QUADAGENT

Malware

uses

to Query Registry

Technique

uses

to RDAT

Malware

uses

to Reg

Tool

uses

to Remote Access Tools

Technique

uses

to Remote Desktop Protocol

Technique

uses

to RGDoor

Malware

uses

to SampleCheck5000

Malware

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to SEASHARPEE

Malware

uses

to SideTwist

Malware

uses

to Solar

Malware

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Spearphishing via Service

Technique

uses

to SSH

Technique

uses

to Supply Chain Compromise

Technique

uses

to System Checks

Technique

uses

to Systeminfo

Tool

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Tasklist

Tool

uses

to Tool

Technique

uses

to Upload Malware

Technique

uses

to Valid Accounts

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Web Shell

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Credential Manager

Technique

uses

to Windows Host Firewall

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Service

Technique

uses

to ZeroCleare

Malware

29 external

References

mitre-attack

G0049

open

IRN2

—

ITG13

—

Hazel Sandstorm

—

EUROPIUM

—

OilRig

—

TA452

—

COBALT GYPSY

—

Crambus

—

Earth Simnavaz

—

Helix Kitten

—

Evasive Serpens

—

Check Point APT34 April 2021

https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/

open

ClearSky OilRig Jan 2017

http://www.clearskysec.com/oilrig/

open

Trend Micro Earth Simnavaz October 2024

https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html

open

Palo Alto OilRig May 2016

http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/

open

Palo Alto OilRig April 2017

http://researchcenter.paloaltonetworks.com/2017/04/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/

open

Palo Alto OilRig Oct 2016

http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/

open

IBM ZeroCleare Wiper December 2019

https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/

open

Unit 42 QUADAGENT July 2018

https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/

open

Crowdstrike Helix Kitten Nov 2018

https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open

Proofpoint Iranian Aligned Attacks JAN 2020

https://www.proofpoint.com/us/corporate-blog/post/iranian-state-sponsored-and-aligned-attacks-what-you-need-know-and-steps-protect

open

FireEye APT34 Dec 2017

https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html

open

Secureworks COBALT GYPSY Threat Profile

https://www.secureworks.com/research/threat-profiles/cobalt-gypsy

open

Symantec Crambus OCT 2023

https://www.security.com/threat-intelligence/crambus-middle-east-government

open

APT34

—

Unit 42 Playbook Dec 2017

https://pan-unit42.github.io/playbook_viewer/

open

Unit42 OilRig Playbook 2023

https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens

open