MITRE ATT&CKgroup

G0049 OilRig

Published 2017-12-14 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics
Aliases
COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452
Version
5.0
Created
2017-12-14

Description

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.

Related

Uses · MITRE ATT&CK (112)

  • T1701.001 PowerShell sub-technique
  • T1701.004 Visual Basic sub-technique
  • T1686.003 Windows Host Firewall sub-technique
  • S1173 PowerExchange software (malware)
  • S1170 ODAgent software (malware)
  • S1171 OilCheck software (malware)
  • S1172 OilBooster software (malware)
  • S1168 SampleCheck5000 software (malware)
  • S1169 Mango software (malware)
  • S1166 Solar software (malware)
  • S1151 ZeroCleare software (malware)
  • T1027.013 Encrypted/Encoded File sub-technique
  • S0508 ngrok software (tool)
  • S0610 SideTwist software (malware)
  • T1608.001 Upload Malware sub-technique
  • T1555.004 Windows Credential Manager sub-technique
  • T1586.002 Email Accounts sub-technique
  • T1587.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T1588.003 Code Signing Certificates sub-technique
  • T1583.001 Domains sub-technique
  • S0495 RDAT software (malware)
  • T0817 Drive-by Compromise technique
  • T0859 Valid Accounts technique
  • T0865 Spearphishing Attachment technique
  • T0869 Standard Application Layer Protocol technique
  • T1027.005 Indicator Removal from Tools sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
Show all 112 ›

Referenced by MITRE ATT&CK · attributed to (2)

  • C0044 Juicy Mix campaign
  • C0042 Outer Space campaign

References