OilRig

Overview

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.

Naming & attribution

OilRig is tracked under 12 names across the industry. It uses 76 documented ATT&CK techniques — more than 94% of the 174 groups tracked here. Activity attributed since at least 2014.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1137.004 Outlook Home Page — used by 1 of 174 groups
• T1195 Supply Chain Compromise — used by 3 of 174 groups
• T1201 Password Policy Discovery — used by 3 of 174 groups
• T1556.002 Password Filter DLL — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Threat Group-3390 China — 32 shared techniques (32% overlap)
• FIN7 — 33 shared techniques (30% overlap)
• APT39 Iran — 30 shared techniques (30% overlap)
• Mustang Panda China — 35 shared techniques (28% overlap)
• APT32 Vietnam — 34 shared techniques (28% overlap)
• Volt Typhoon China — 34 shared techniques (28% overlap)

Targets

Chemical · Civil society · Defense · Education · Energy · Engineering · Finance · Government · Other · Private sector · Technology · Telecommunications

Regions

Canada · China · France · Germany · India · Iraq · Israel · Kuwait · Lebanon · Mexico · Middle East · Pakistan · Qatar · Saudi Arabia · South Korea · Turkey · United Kingdom · United States

Capabilities

• Supply-chain compromise — ATT&CK T1195
• Destructive / data-wiping operations — software: ZeroCleare
• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 18 attributed custom malware families
• Documented tooling: Watering holes, 64-bit malware, covert C2 via IPv6 DNS, ISMDOOR — MISP galaxy (meta.capabilities)

TTPs — 76 techniques across 13 tactics

Tools & malware (30)

ISMInjector · ODAgent · RDAT · Systeminfo · QUADAGENT · OopsIE · ngrok · Tasklist · Net · certutil · ZeroCleare · Reg · POWRUNER · netstat · Solar · ipconfig · LaZagne · BONDUPDATER · SideTwist · Helminth · Mango · OilBooster · SampleCheck5000 · PsExec · SEASHARPEE · Mimikatz · PowerExchange · OilCheck · RGDoor · ftp

Reporting (3)

• Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East — Fahmy, M. et al
• Crambus: New Campaign Targets Middle Eastern Government — Symantec Threat Hunter Team
• How Microsoft names threat actors — Microsoft