Tuesday, May 28, 2024

OilRig: Never-seen C#/.NET Backdoor to Attack Wide Range of Industries

OilRig (APT34) is an Iranian cyberespionage group active since 2014, targeting Middle Eastern governments and various industries like:-

  • Chemical
  • Energy
  • Finance
  • Telecom

OilRig launched DNSpionage in 2018-2019 against Lebanon and the UAE, followed by the 2019-2020 HardPass campaign using LinkedIn for energy and government sector targets.

Recently, the cybersecurity researchers at ESET have identified and analyzed two OilRig APT group’s campaigns:- 

  • Outer Space (2021)
  • Juicy Mix (2022)

These cyberespionage campaigns exclusively targeted Israeli organizations, following their Middle East focus. They infiltrated via legitimate websites, employing VBS droppers for C#/.NET backdoors and post-compromise data tools.


Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Campaign Overview

  • Outer Space: It’s an OilRig campaign from 2021 that used an Israeli HR site as a C&C server for the Solar backdoor. Here, with basic functions, the Solar led to SC5k downloader, while MKG was used for browser data exfiltration.
OilRig’s Outer Space compromise chain (Source – ESET)
  • Juicy Mix: In 2022, OilRig launched a fresh campaign, Juicy Mix, targeting Israeli groups with upgraded tools, compromising a job portal for C&C, then hitting an Israeli healthcare org with Mango backdoor, two secret browser-data dumpers, and a Credential Manager stealer.
Components used in OilRig’s Juicy Mix campaign (Source – ESET)

Technical Analysis

Both campaigns used VBS droppers, likely delivered via spearphishing emails to establish system access. 

These droppers delivered Mango, ensured persistence, and connected to the C&C server. At the same time, the embedded backdoor used base64 encoding and simple string deobfuscation for concealment.

After embedding the backdoor, the dropper schedules Mango (or Solar) to run every 14 minutes and sends the compromised computer’s name via a base64-encoded POST request to the C&C server.

OilRig’s Outer Space campaign deploys Solar, a simple yet versatile backdoor capable of downloading, executing files, and autonomously exfiltrating staged data.

flow of Solar
Initial execution flow of Solar (Source – ESET)

OilRig replaced Solar with Mango in Juicy Mix, sharing a familiar workflow and capabilities but featuring significant distinctions.

Mango initiates an in-memory task running every 32 seconds like Solar, communicates with the C&C server, and executes commands. However, Mango differs by replacing Solar’s Venus task with a new exfiltration command.

Post-compromise tools

Here below, we have mentioned all the post-compromise tools:-

  • SampleCheck5000 (SC5k) downloader
  • Browser-data dumpers
  • Windows Credential Manager stealer

With backdoor-like implants, OilRig advances from Solar to Mango. They still utilize conventional techniques to obtain user data while using specialized technologies for data collection.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

Researchers Exploited Nexus Repository Using Directory Traversal Vulnerability

Hackers target and exploit GitHub repositories for a multitude of reasons and illicit purposes.The...

DDNS Service In Fortinet Or QNAP Embedded Devices Exposes Sensitive Data, Researchers Warn

Hackers employ DNS for various purposes like redirecting traffic to enable man-in-the-middle attacks, infecting...

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles