OilRig
Also tracked as COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.
- Documented techniques
- 76
- Assessed origin
- Iran
- First seen
- 2014
- Basis
- MITRE ATT&CK
How they break in
Techniques MITRE has documented this group using, grouped by the stage of an attack they belong to. This is the actionable half: each one is a behaviour you can look for in your own logs, and a control you can test.
resource development6
initial access4
execution9
persistence4
privilege escalation1
credential access8
discovery14
- T1007 System Service Discovery
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1046 Network Service Discovery
- T1049 System Network Connections Discovery
- T1057 Process Discovery
- T1069.001 Local Groups
- T1069.002 Domain Groups
- T1082 System Information Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1120 Peripheral Device Discovery
- T1201 Password Policy Discovery
lateral movement2
collection6
command and control7
defense impairment4
stealth10
- T1027.005 Indicator Removal from Tools
- T1027.013 Encrypted/Encoded File
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1140 Deobfuscate/Decode Files or Information
- T1218.001 Compiled HTML File
- T1497.001 System Checks
Malware
Families MITRE records this group deploying. Detection names for these are a reasonable place to start.
Tools
Legitimate or dual-use software the group is documented using. Most of it is software your own administrators use too, which is the point.