Article Content Iranian threat agent OilRig has been targeting multiple organisations in Israel and other countries in the Middle East since the end of 2015 In recent attacks they set up a fake VPN Web Portal and targeted at least five Israeli IT vendors, several financial institutes, and the Israeli Post Office Later, the attackers set up two fake websites pretending to be a University of Oxford conference sign-up page and a job application website Fake VPN Web Portal In one of the recent cases, the attackers sent the following email to individuals in targeted organisations:  The email was sent from a compromised account of an IT vendor Similar emails were sent from other IT vendors in the same time period, suggesting the attackers had a foothold within their networks, or at least could get access to specific computers or email accounts The legitimate and the malicious installations can be seen in the process tree when the file is run in a Cuckoo sandbox (Note that Juniper networks was not compromised nor otherwise involved in the attack, except for the attackers using its name and publicly available software) Alternatively, the attackers might have got Symantec to issue them a certificate under Ai Squared’s name [Update 11 February 2017: In a notification in its website, Ai Squared says that “The digital certificate used to certify newer ZoomText and Window-Eyes software products has been compromised. As a result, our certificate will be revoked on or around January 26th”] University of Oxford impersonation The attackers registered four domains impersonating The University of Oxford oxford-symposia[.]com, is a fake Oxford conference registration website The attackers used a forth domain, oxford-employee[.]com, to host an “Oxford Job application” website:  Visitors are asked to “Download CV Creator” in order “To Join University of Oxford staff” CV Creator is a malicious file hosted at http://www.oxford-careers[.]com/Files/OxfordCVCreator.exe : OxfordCVCreator.exe 5713c3c01067c91771ac70e193ef5419 When run, the victim is again presented with a tool created by the attackers, this time a “University Of Oxford Official CV Creator”:  Both samples mentioned in this section had the following domain used for command and control: updater[.]li Other incidents In an earlier incident, the attackers sent a malicious excel file impersonating Israir, an Israeli Airline  (the content of the file was copied from the company’s public website and we have no indication of it being compromised or targeted): Israel Airline.xls 197c018922237828683783654d3c632a  The file had a macro that if enabled by the user would infect its computer In other incidents the attackers used the following files:   Special Offers.xls / Salary Employee 2016.xls f76443385fef159e6b73ad6bf7f086d6 pic.xls 3a5fcba80c1fd685c4b5085d9d474118  People List.xls bd7d2efdb2a0f352c4b74f2b82e3c7bc cv.xls 72e046753f0496140b4aa389aee2e300 users.xls 262bc259682cb48ce66a80dcc9a5d587 Employee Engagement Survey.xls 726175e9aba421aa0f96cfc005664302 JuniperSetupClientInstaller.exe f8ce7e356e09de6a48dca9e51421b6f6 Project_Domain_No337.chm 1792cdd0c5397ff5df445d73276d1a50 (undetected as malicious by any antivirus on VirusTotal) gcaa_report_series15561.chm d50ab63f4034c6f5eb356e3326320e66 (undetected as malicious by any antivirus on VirusTotal)  Infrastructure overlap with Cadelle and Chafer In December 2015, Symantec published a post about “two Iran-based attack groups that appear to be connected, Cadelle and Chafer” that  “have been using Backdoor.Cadelspy and Backdoor.Remexi to spy on Iranian individuals and Middle Eastern organizations” This suggest that the two groups may actually be the same entity, or that they share resources in one why or another Indicators of compromise Indicators file: oilrig-indicators.csv (also available on PassiveTotal) The graph below depicts the OilRig infrastructure (click to enlarge):    Acknowledgments This research was facilitated by PassiveTotal for threat infrastructure analysis, and by MalNet for malware research 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Iranian threat agent OilRig has been targeting multiple organisations in Israel and other countries in the Middle East since the end of 2015 In recent attacks they set up a fake VPN Web Portal and targeted at least five Israeli IT vendors, several financial institutes, and the Israeli Post Office Later, the attackers set up two fake websites pretending to be a University of Oxford conference sign-up page and a job application website Fake VPN Web Portal In one of the recent cases, the attackers sent the following email to individuals in targeted organisations:  The email was sent from a compromised account of an IT vendor Similar emails were sent from other IT vendors in the same time period, suggesting the attackers had a foothold within their networks, or at least could get access to specific computers or email accounts The legitimate and the malicious installations can be seen in the process tree when the file is run in a Cuckoo sandbox (Note that Juniper networks was not compromised nor otherwise involved in the attack, except for the attackers using its name and publicly available software) Alternatively, the attackers might have got Symantec to issue them a certificate under Ai Squared’s name [Update 11 February 2017: In a notification in its website, Ai Squared says that “The digital certificate used to certify newer ZoomText and Window-Eyes software products has been compromised. As a result, our certificate will be revoked on or around January 26th”] University of Oxford impersonation The attackers registered four domains impersonating The University of Oxford oxford-symposia[.]com, is a fake Oxford conference registration website The attackers used a forth domain, oxford-employee[.]com, to host an “Oxford Job application” website:  Visitors are asked to “Download CV Creator” in order “To Join University of Oxford staff” CV Creator is a malicious file hosted at http://www.oxford-careers[.]com/Files/OxfordCVCreator.exe : OxfordCVCreator.exe 5713c3c01067c91771ac70e193ef5419 When run, the victim is again presented with a tool created by the attackers, this time a “University Of Oxford Official CV Creator”:  Both samples mentioned in this section had the following domain used for command and control: updater[.]li Other incidents In an earlier incident, the attackers sent a malicious excel file impersonating Israir, an Israeli Airline  (the content of the file was copied from the company’s public website and we have no indication of it being compromised or targeted): Israel Airline.xls 197c018922237828683783654d3c632a  The file had a macro that if enabled by the user would infect its computer In other incidents the attackers used the following files:   Special Offers.xls / Salary Employee 2016.xls f76443385fef159e6b73ad6bf7f086d6 pic.xls 3a5fcba80c1fd685c4b5085d9d474118  People List.xls bd7d2efdb2a0f352c4b74f2b82e3c7bc cv.xls 72e046753f0496140b4aa389aee2e300 users.xls 262bc259682cb48ce66a80dcc9a5d587 Employee Engagement Survey.xls 726175e9aba421aa0f96cfc005664302 JuniperSetupClientInstaller.exe f8ce7e356e09de6a48dca9e51421b6f6 Project_Domain_No337.chm 1792cdd0c5397ff5df445d73276d1a50 (undetected as malicious by any antivirus on VirusTotal) gcaa_report_series15561.chm d50ab63f4034c6f5eb356e3326320e66 (undetected as malicious by any antivirus on VirusTotal)  Infrastructure overlap with Cadelle and Chafer In December 2015, Symantec published a post about “two Iran-based attack groups that appear to be connected, Cadelle and Chafer” that  “have been using Backdoor.Cadelspy and Backdoor.Remexi to spy on Iranian individuals and Middle Eastern organizations” This suggest that the two groups may actually be the same entity, or that they share resources in one why or another Indicators of compromise Indicators file: oilrig-indicators.csv (also available on PassiveTotal) The graph below depicts the OilRig infrastructure (click to enlarge):    Acknowledgments This research was facilitated by PassiveTotal for threat infrastructure analysis, and by MalNet for malware research  ### Response: .