OilRig (APT34) is an Iranian cyberespionage group active since 2014, targeting Middle Eastern governments and various industries like:-
OilRig launched DNSpionage in 2018-2019 against Lebanon and the UAE, followed by the 2019-2020 HardPass campaign using LinkedIn for energy and government sector targets.
Recently, the cybersecurity researchers at ESET have identified and analyzed two OilRig APT group’s campaigns:-
These cyberespionage campaigns exclusively targeted Israeli organizations, following their Middle East focus. They infiltrated via legitimate websites, employing VBS droppers for C#/.NET backdoors and post-compromise data tools.
Both campaigns used VBS droppers, likely delivered via spearphishing emails to establish system access.
These droppers delivered Mango, ensured persistence, and connected to the C&C server. At the same time, the embedded backdoor used base64 encoding and simple string deobfuscation for concealment.
After embedding the backdoor, the dropper schedules Mango (or Solar) to run every 14 minutes and sends the compromised computer’s name via a base64-encoded POST request to the C&C server.
OilRig’s Outer Space campaign deploys Solar, a simple yet versatile backdoor capable of downloading, executing files, and autonomously exfiltrating staged data.
OilRig replaced Solar with Mango in Juicy Mix, sharing a familiar workflow and capabilities but featuring significant distinctions.
Mango initiates an in-memory task running every 32 seconds like Solar, communicates with the C&C server, and executes commands. However, Mango differs by replacing Solar’s Venus task with a new exfiltration command.
Here below, we have mentioned all the post-compromise tools:-
With backdoor-like implants, OilRig advances from Solar to Mango. They still utilize conventional techniques to obtain user data while using specialized technologies for data collection.
The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…
White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…
Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…
The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…
Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…
WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…