# OilRig: threat group profile

> OilRig is an espionage group thought to operate from Iran, with suspected state backing. Public reporting links it to 41 attack techniques, and to attacks on government, private sector and civil society organisations, with 8 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.precursorintelligence.com/threat-actors/oilrig
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > OilRig

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 41 (plus 33 sub-techniques) |
| Countries and victims named | 8 |
| Thought to operate from | Iran |
| Suspected backing | Iran |
| Motive | Espionage |
| Other names | 14 |
| Public reports | 35 |

## Who is OilRig?

OilRig is an espionage group thought to operate from Iran, with suspected state backing. Public reporting links it to 41 attack techniques, and to attacks on government, private sector and civil society organisations, with 8 countries and victims named.

### Also known as

Twisted Kitten, Cobalt Gypsy, Crambus, Helix Kitten, APT 34, APT34, IRN2, ATK40, G0049, Evasive Serpens, Hazel Sandstorm, EUROPIUM, TA452, Earth Simnavaz

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> OilRig is an Iranian threat group operating primarily in the Middle East by targeting organizations in this region that are in a variety of different industries; however, this group has occasionally targeted organizations outside of the Middle East as well. It also appears OilRig carries out supply chain attacks, where the threat group leverages the trust relationship between organizations to attack their primary targets.   OilRig is an active and organized threat group, which is evident based on their systematic targeting of specific organizations that appear to be carefully chosen for strategic purposes. Attacks attributed to this group primarily rely on social engineering to exploit the human rather than software vulnerabilities; however, on occasion this group has used recently patched vulnerabilities in the delivery phase of their attacks. The lack of software vulnerability exploitation does not necessarily suggest a lack of sophistication, as OilRig has shown maturity in other aspects of their operations. Such maturities involve:  -Organized evasion testing used the during development of their tools. -Use of custom DNS Tunneling protocols for command and control (C2) and data exfiltration. -Custom web-shells and backdoors used to persistently access servers.  OilRig relies on stolen account credentials for lateral movement. After OilRig gains access to a system, they use credential dumping tools, such as Mimikatz, to steal credentials to accounts logged into the compromised system. The group uses these credentials to access and to move laterally to other systems on the network. After obtaining credentials from a system, operators in this group prefer to use tools other than their backdoors to access the compromised systems, such as remote desktop and putty. OilRig also uses phishing sites to harvest credentials to individuals at targeted organizations to gain access to internet accessible resources, such as Outlook Web Access. Since at least 2014, an Iranian threat group tracked by FireEye as APT34 has conducted reconnaissance aligned with the strategic interests of Iran. The group conducts operations primarily in the Middle East, targeting financial, government, energy, chemical, telecommunications and other industries. Repeated targeting of Middle Eastern financial, energy and government organizations leads FireEye to assess that those sectors are a primary concern of APT34. The use of infrastructure tied to Iranian operations, timing and alignment with the national interests of Iran also lead FireEye to assess that APT34 acts on behalf of the Iranian government.

## How does OilRig attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 41 linked to OilRig. Some techniques belong to more than one stage. Public reporting also lists 33 more specific variations of them, called sub-techniques.

### 1. Research (0)

- None linked in public reporting.

### 2. Preparation (0)

- None linked in public reporting.

### 3. Getting in (3)

- T1078: Valid Accounts
- T1133: External Remote Services
- T1566: Phishing

### 4. Running code (4)

- T1047: Windows Management Instrumentation
- T1053: Scheduled Task/Job
- T1059: Command and Scripting Interpreter
- T1204: User Execution

### 5. Staying in (5)

- T1053: Scheduled Task/Job
- T1078: Valid Accounts
- T1133: External Remote Services
- T1137: Office Application Startup
- T1505: Server Software Component

### 6. Taking control (2)

- T1053: Scheduled Task/Job
- T1078: Valid Accounts

### 7. Hiding (7)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1070: Indicator Removal
- T1078: Valid Accounts
- T1140: Deobfuscate/Decode Files or Information
- T1218: System Binary Proxy Execution
- T1497: Virtualization/Sandbox Evasion

### 8. Disabling defences (0)

- None linked in public reporting.

### 9. Stealing passwords (5)

- T1003: OS Credential Dumping
- T1056: Input Capture
- T1110: Brute Force
- T1552: Unsecured Credentials
- T1555: Credentials from Password Stores

### 10. Looking around (13)

- T1007: System Service Discovery
- T1012: Query Registry
- T1016: System Network Configuration Discovery
- T1033: System Owner/User Discovery
- T1046: Network Service Discovery
- T1049: System Network Connections Discovery
- T1057: Process Discovery
- T1069: Permission Groups Discovery
- T1082: System Information Discovery
- T1087: Account Discovery
- T1120: Peripheral Device Discovery
- T1201: Password Policy Discovery
- T1497: Virtualization/Sandbox Evasion

### 11. Spreading (1)

- T1021: Remote Services

### 12. Gathering data (3)

- T1056: Input Capture
- T1113: Screen Capture
- T1119: Automated Collection

### 13. Keeping contact (5)

- T1008: Fallback Channels
- T1071: Application Layer Protocol
- T1105: Ingress Tool Transfer
- T1572: Protocol Tunneling
- T1573: Encrypted Channel

### 14. Taking data out (1)

- T1048: Exfiltration Over Alternative Protocol

### 15. Causing damage (0)

- None linked in public reporting.

## Who does OilRig go after?

**Sectors:** Government, Private sector, Civil society

**Countries and victims named:** Israel, Kuwait, United States, Turkey, Saudi Arabia, Qatar, Lebanon, Middle East

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about OilRig

- https://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability
- https://unit42.paloaltonetworks.com/unit42-striking-oil-closer-look-adversary-infrastructure/
- https://unit42.paloaltonetworks.com/unit42-introducing-the-adversary-playbook-first-up-oilrig/
- https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/
- https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
- https://unit42.paloaltonetworks.com/unit42-twoface-webshell-persistent-access-point-lateral-movement/
- https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/
- https://unit42.paloaltonetworks.com/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/
- https://unit42.paloaltonetworks.com/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/
- https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/
- https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/
- https://unit42.paloaltonetworks.com/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/
- https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/
- https://pan-unit42.github.io/playbook_viewer/
- https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html
- https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html
- https://www.gov.il/BlobFolder/reports/attack_il/he/CERT-IL-ALERT-W-120.pdf
- https://www.forbes.com/sites/thomasbrewster/2017/02/15/oilrig-iran-hackers-cyberespionage-us-turkey-saudi-arabia/#56749aa2468a
- https://raw.githubusercontent.com/pan-unit42/playbook_viewer/master/playbook_json/oilrig.json
- https://www.cfr.org/interactive/cyber-operations/oilrig
- https://www.cfr.org/interactive/cyber-operations/apt-34
- https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/shamoon-destructive-threat-re-emerges-new-sting-its-tail
- https://web.archive.org/web/20120818235442/https://www.symantec.com/connect/blogs/shamoon-attacks
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ad6f8259-2bb4-4f7f-b8e1-710b35a4cbed&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
- https://www.clearskysec.com/oilrig/
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/
- https://attack.mitre.org/groups/G0049/
- https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/
- https://www.secureworks.com/research/threat-profiles/cobalt-gypsy
- https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf
- https://www.wired.com/story/apt-34-iranian-hackers-critical-infrastructure-companies/
- https://unit42.paloaltonetworks.com/atoms/evasive-serpens/
- https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/
- https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html

## Frequently asked questions

### Who is OilRig?

OilRig is an espionage group thought to operate from Iran, with suspected state backing. Public reporting links it to 41 attack techniques, and to attacks on government, private sector and civil society organisations, with 8 countries and victims named.

### Where is OilRig thought to be based?

Public reporting places OilRig as operating from Iran, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does OilRig target?

In public reporting, sectors named include government, private sector and civil society, and 8 countries and victims are named, including Israel, Kuwait, United States and Turkey.

### How does OilRig attack?

Public reporting links OilRig to 41 attack techniques. Most of them are about looking around, hiding and staying in.

### How do I know if OilRig is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact