OilRig
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.
- ATT&CK ID
- G0049
- Origin
- Iran
- Weather family
- Sandstorm
- Techniques
- 58
- Tools
- 30
Also tracked as COBALT GYPSY · IRN2 · APT34 · Helix Kitten · Evasive Serpens · Hazel Sandstorm · EUROPIUM · ITG13 · Earth Simnavaz · Crambus · TA452
Vulnerabilities it has exploited
- CVE-2017-11774 Microsoft OfficeUnscored · exploited in the wild
- CVE-2024-30088 Microsoft Windows Unscored · exploited in the wild
Techniques
Resource Development
Acquire InfrastructureCompromise AccountsDevelop CapabilitiesObtain CapabilitiesStage Capabilities
Initial Access
Valid AccountsExternal Remote ServicesSupply Chain CompromisePhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterExploitation for Client ExecutionUser Execution
Persistence
Scheduled Task/JobValid AccountsModify RegistryExternal Remote ServicesOffice Application StartupServer Software ComponentCreate or Modify System ProcessModify Authentication Process
Privilege Escalation
Scheduled Task/JobExploitation for Privilege EscalationValid AccountsCreate or Modify System Process
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalValid AccountsDeobfuscate/Decode Files or InformationSystem Binary Proxy ExecutionVirtualization/Sandbox Evasion
Defense Impairment
Modify RegistrySubvert Trust ControlsModify Authentication ProcessDisable or Modify System Firewall
Credential Access
OS Credential DumpingInput CaptureBrute ForceUnsecured CredentialsCredentials from Password StoresModify Authentication Process
Discovery
System Service DiscoveryQuery RegistrySystem Network Configuration DiscoverySystem Owner/User DiscoveryNetwork Service DiscoverySystem Network Connections DiscoveryProcess DiscoveryPermission Groups DiscoverySystem Information DiscoveryAccount DiscoveryPeripheral Device DiscoveryPassword Policy DiscoveryVirtualization/Sandbox Evasion
Lateral Movement
Collection
Data from Local SystemData from Removable MediaInput CaptureScreen CaptureClipboard DataAutomated Collection
Command and Control
Fallback ChannelsApplication Layer ProtocolIngress Tool TransferRemote Access ToolsProtocol TunnelingEncrypted Channel
Exfiltration
Exfiltration Over Alternative Protocol
Software
BONDUPDATER · Helminth · ISMInjector · LaZagne · Mango · Mimikatz · Net · ODAgent · OilBooster · OilCheck · OopsIE · POWRUNER · PowerExchange · PsExec · QUADAGENT · RDAT · RGDoor · Reg · SEASHARPEE · SampleCheck5000 · SideTwist · Solar · Systeminfo · Tasklist · ZeroCleare · certutil · ftp · ipconfig · netstat · ngrok