[CyberThreat] OilRig: An In-Depth Analysis of a Persistent Threat Actor

A.I. support for text and images

Introduction

OilRig, also known as APT34, Helix Kitten, and OwaAuth, is a sophisticated cyber espionage group with a history of targeting organizations in the Middle East. The group is believed to be linked to the Iranian government, primarily focusing on intelligence gathering against financial, energy, telecommunications, and critical infrastructure sectors. Known for its strategic use of social engineering, spear-phishing, and custom malware, OilRig has consistently adapted its techniques and tools to evade detection and achieve its objectives.

Real-World Cases Involving OilRig

1. Operation CopyKittens (2017): OilRig targeted multiple government entities and organizations in Saudi Arabia, Israel, and the United States. The campaign was notable for its use of DNS tunneling, allowing the group to exfiltrate data covertly. The attackers used a variety of malware families, including POWBAT, ISMDOOR, and SHAPESHIFT, to maintain persistence and evade detection.
2. Campaign Against Lebanese Entities (2018): In 2018, OilRig launched a campaign against organizations in Lebanon, using the newly developed “DNSpionage” malware. This campaign included sophisticated spear-phishing emails that directed victims to malicious websites designed to look like legitimate government and private sector login portals. Once credentials were harvested, the attackers deployed the DNSpionage malware to establish remote control over the compromised systems.
3. STEKETEE Campaign (2020): OilRig was linked to the STEKETEE campaign, which targeted financial and energy sectors in the Middle East. The group used the PowGoop malware — a loader that decrypts and executes a .NET-based malware payload. This campaign demonstrated the group’s ability to develop new tools and use diverse methods to gain initial access, including exploiting vulnerabilities in public-facing web applications.

Attack Techniques and Tools

OilRig is known for employing a wide array of tactics, techniques, and procedures (TTPs) to achieve its goals. Some of the key techniques include:

• Spear-Phishing (T1566): OilRig frequently uses spear-phishing emails to gain initial access to target systems. These emails often contain malicious attachments or links to phishing websites designed to steal credentials.
• Web Shells (T1505.003): The group uses web shells on compromised web servers to maintain persistent access. These web shells allow the attackers to execute commands remotely, exfiltrate data, and deploy additional malware.
• Custom Malware: OilRig has developed a suite of custom malware tools, including:
• Karkoff: A backdoor designed for data exfiltration and system monitoring.
• DNSpionage: Malware that uses DNS tunneling for command-and-control communication.
• TONEDEAF: A backdoor capable of downloading and executing additional payloads, as well as stealing credentials.
• Credential Dumping (T1003): The group often uses credential dumping tools like Mimikatz to extract usernames and passwords from compromised systems, enabling lateral movement within the target network.
• DNS Tunneling (T1071.004): OilRig uses DNS tunneling as a method of covert communication between infected hosts and command-and-control servers. This technique is particularly effective in environments with restricted internet access.

MITRE ATT&CK Techniques

OilRig’s activities are well-documented in the MITRE ATT&CK framework, highlighting the breadth of their capabilities. Some key techniques associated with OilRig include:

Initial Access:

• T1192: Spear-phishing Link
• T1078: Valid Accounts

Execution:

• T1059: Command and Scripting Interpreter
• T1569: System Services

Persistence:

• T1547: Boot or Logon Autostart Execution
• T1505: Server Software Component

Privilege Escalation:

• T1078: Valid Accounts
• T1055: Process Injection

Defense Evasion:

• T1070: Indicator Removal
• T1027: Obfuscated Files or Information

Credential Access:

• T1003: Credential Dumping

Exfiltration:

• T1048: Exfiltration Over Alternative Protocol
• T1071: Application Layer Protocol

Conclusion

OilRig remains one of the most active and persistent threat actors targeting the Middle East, with a clear focus on cyber espionage. Their use of custom malware, combined with advanced social engineering tactics, demonstrates a high level of sophistication and adaptability. Organizations in the region must stay vigilant, continuously updating their security protocols and educating their personnel about the evolving threat landscape.

By understanding OilRig’s methods and leveraging resources like the MITRE ATT&CK framework, defenders can better anticipate, detect, and mitigate attacks from this persistent adversary.

External Resources

For more detailed information and in-depth reports on OilRig (APT34), you can refer to the following resources from major cybersecurity organizations:

• MITRE Threat Profile: here
• Malpedia Threat Profile & Info: here
• NSA, CISA, and FBI Joint Advisory: This advisory provides information on custom exfiltration tools used against the Defense Industrial Base (DIB) sector by various threat actors, including APT34. It includes TTPs and indicators of compromise related to the misuse of Impacket and CovalentStealer tools. You can read more about it on the NSA’s official page【18】.
• CrowdStrike — 2024 Global Threat Report: Questo report analizza in dettaglio le minacce globali, incluse le attività del gruppo OilRig. Fornisce informazioni su tattiche e tecniche avanzate utilizzate dagli attori delle minacce, inclusi attacchi alla supply chain e sfruttamento di credenziali valide. È un documento chiave per comprendere l’evoluzione delle minacce cibernetiche. CrowdStrike 2024 Global Threat Report​ (CrowdStrike).
• CrowdStrike — MITRE ATT&CK Framework: Un’introduzione al framework MITRE ATT&CK che descrive tattiche e tecniche utilizzate da gruppi come OilRig. Fornisce una panoramica delle metodologie usate per identificare e contrastare le attività avversarie. È utile per comprendere le correlazioni tra i diversi gruppi di minacce e le tecniche che utilizzano. MITRE ATT&CK Framework Overview​ (CrowdStrike).
• CrowdStrike — Global Threat Landscape: Una panoramica delle minacce globali e degli attori delle minacce attivi. Include dettagli sugli avversari più rilevanti, come OilRig, e sulle loro attività recenti. È utile per comprendere le tendenze attuali nel panorama delle minacce cibernetiche. CrowdStrike Threat Landscape​ (CrowdStrike).

These resources contain comprehensive details on the tactics, techniques, and procedures (TTPs) used by OilRig, along with mitigation recommendations for organizations to protect against similar threats.

A.I. support for text and images