OilRig - G0049

Created: 2017-12-14T16:46:06.044Z

Modified: 2023-02-06T20:58:52.317Z

Contributors: Robert Falcone,Bryan Lee,Dragos  Threat  Intelligence

Aliases

OilRig,COBALT GYPSY,IRN2,APT34,Helix Kitten,Evasive Serpens

Description

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.(Citation: Palo Alto OilRig April 2017)(Citation: ClearSky OilRig Jan 2017)(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGENT July 2018)

Techniques Used

OilRig has used tools to identify if a mouse is connected to a targeted system.(Citation: Check Point APT34 April 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

OilRig has used VBSscipt macros for execution on compromised hosts.(Citation: Check Point APT34 April 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1497.001|System Checks|

OilRig has used macros to verify if a mouse is connected to a compromised machine.(Citation: Check Point APT34 April 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|