Saturday, May 17, 2025
HomeCyber AttackOilRig: Never-seen C#/.NET Backdoor to Attack Wide Range of Industries

OilRig: Never-seen C#/.NET Backdoor to Attack Wide Range of Industries

Published on

SIEM as a Service

Follow Us on Google News

OilRig (APT34) is an Iranian cyberespionage group active since 2014, targeting Middle Eastern governments and various industries like:-

  • Chemical
  • Energy
  • Finance
  • Telecom

OilRig launched DNSpionage in 2018-2019 against Lebanon and the UAE, followed by the 2019-2020 HardPass campaign using LinkedIn for energy and government sector targets.

Recently, the cybersecurity researchers at ESET have identified and analyzed two OilRig APT group’s campaigns:- 

- Advertisement - Google News
  • Outer Space (2021)
  • Juicy Mix (2022)

These cyberespionage campaigns exclusively targeted Israeli organizations, following their Middle East focus. They infiltrated via legitimate websites, employing VBS droppers for C#/.NET backdoors and post-compromise data tools.

Campaign Overview

  • Outer Space: It’s an OilRig campaign from 2021 that used an Israeli HR site as a C&C server for the Solar backdoor. Here, with basic functions, the Solar led to SC5k downloader, while MKG was used for browser data exfiltration.
OilRig
OilRig’s Outer Space compromise chain (Source – ESET)
  • Juicy Mix: In 2022, OilRig launched a fresh campaign, Juicy Mix, targeting Israeli groups with upgraded tools, compromising a job portal for C&C, then hitting an Israeli healthcare org with Mango backdoor, two secret browser-data dumpers, and a Credential Manager stealer.
OilRig
Components used in OilRig’s Juicy Mix campaign (Source – ESET)

Technical Analysis

Both campaigns used VBS droppers, likely delivered via spearphishing emails to establish system access. 

These droppers delivered Mango, ensured persistence, and connected to the C&C server. At the same time, the embedded backdoor used base64 encoding and simple string deobfuscation for concealment.

After embedding the backdoor, the dropper schedules Mango (or Solar) to run every 14 minutes and sends the compromised computer’s name via a base64-encoded POST request to the C&C server.

OilRig’s Outer Space campaign deploys Solar, a simple yet versatile backdoor capable of downloading, executing files, and autonomously exfiltrating staged data.

flow of Solar
Initial execution flow of Solar (Source – ESET)

OilRig replaced Solar with Mango in Juicy Mix, sharing a familiar workflow and capabilities but featuring significant distinctions.

Mango initiates an in-memory task running every 32 seconds like Solar, communicates with the C&C server, and executes commands. However, Mango differs by replacing Solar’s Venus task with a new exfiltration command.

Post-compromise tools

Here below, we have mentioned all the post-compromise tools:-

  • SampleCheck5000 (SC5k) downloader
  • Browser-data dumpers
  • Windows Credential Manager stealer

With backdoor-like implants, OilRig advances from Solar to Mango. They still utilize conventional techniques to obtain user data while using specialized technologies for data collection.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

VMware ESXi, Firefox, Red Hat Linux & SharePoint Hacked – Pwn2Own Day 2

Security researchers demonstrated their prowess on the second day of Pwn2Own Berlin 2025, discovering...

Critical WordPress Plugin Flaw Puts Over 10,000 Sites of Cyberattack

A serious security flaw affecting the Eventin plugin, a popular event management solution for...

Sophisticated NPM Attack Leverages Google Calendar2 for Advanced Communication

A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign...

New Ransomware Attack Targets Elon Musk Supporters Using PowerShell to Deploy Payloads

A newly identified ransomware campaign has emerged, seemingly targeting supporters of Elon Musk through...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

VMware ESXi, Firefox, Red Hat Linux & SharePoint Hacked – Pwn2Own Day 2

Security researchers demonstrated their prowess on the second day of Pwn2Own Berlin 2025, discovering...

Critical WordPress Plugin Flaw Puts Over 10,000 Sites of Cyberattack

A serious security flaw affecting the Eventin plugin, a popular event management solution for...

Sophisticated NPM Attack Leverages Google Calendar2 for Advanced Communication

A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign...