ATT&CKGroupsOilRig

OilRig

G0049

Threat group.View on attack.mitre.org

About this group

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.

Techniques used76

Resource Development6

T1583.001DomainsT1586.002Email AccountsT1587.001MalwareT1588.002ToolT1588.003Code Signing CertificatesT1608.001Upload Malware

Initial Access7

T1078Valid AccountsT1078.002Domain AccountsT1133External Remote ServicesT1195Supply Chain CompromiseT1566.001Spearphishing AttachmentT1566.002Spearphishing LinkT1566.003Spearphishing via Service

Execution9

T1047Windows Management InstrumentationT1053.005Scheduled TaskT1059Command and Scripting InterpreterT1059.001PowerShellT1059.003Windows Command ShellT1059.005Visual BasicT1203Exploitation for Client ExecutionT1204.001Malicious LinkT1204.002Malicious File

Persistence9

T1053.005Scheduled TaskT1078Valid AccountsT1078.002Domain AccountsT1112Modify RegistryT1133External Remote ServicesT1137.004Outlook Home PageT1505.003Web ShellT1543.003Windows ServiceT1556.002Password Filter DLL

Privilege Escalation5

T1053.005Scheduled TaskT1068Exploitation for Privilege EscalationT1078Valid AccountsT1078.002Domain AccountsT1543.003Windows Service

Stealth10

T1027.005Indicator Removal from ToolsT1027.013Encrypted/Encoded FileT1036MasqueradingT1036.005Match Legitimate Resource Name or LocationT1070.004File DeletionT1078Valid AccountsT1078.002Domain AccountsT1140Deobfuscate/Decode Files or InformationT1218.001Compiled HTML FileT1497.001System Checks

Defense Impairment4

T1112Modify RegistryT1553.002Code SigningT1556.002Password Filter DLLT1686.003Windows Host Firewall

Credential Access10

T1003.001LSASS MemoryT1003.004LSA SecretsT1003.005Cached Domain CredentialsT1056.001KeyloggingT1110Brute ForceT1552.001Credentials In FilesT1555Credentials from Password StoresT1555.003Credentials from Web BrowsersT1555.004Windows Credential ManagerT1556.002Password Filter DLL

Discovery15

T1007System Service DiscoveryT1012Query RegistryT1016System Network Configuration DiscoveryT1033System Owner/User DiscoveryT1046Network Service DiscoveryT1049System Network Connections DiscoveryT1057Process DiscoveryT1069.001Local GroupsT1069.002Domain GroupsT1082System Information DiscoveryT1087.001Local AccountT1087.002Domain AccountT1120Peripheral Device DiscoveryT1201Password Policy DiscoveryT1497.001System Checks

Lateral Movement2

T1021.001Remote Desktop ProtocolT1021.004SSH

Collection6

T1005Data from Local SystemT1025Data from Removable MediaT1056.001KeyloggingT1113Screen CaptureT1115Clipboard DataT1119Automated Collection

Command and Control7

T1008Fallback ChannelsT1071.001Web ProtocolsT1071.004DNST1105Ingress Tool TransferT1219Remote Access ToolsT1572Protocol TunnelingT1573.002Asymmetric Cryptography

Exfiltration1

T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

Procedure examples76

TechniqueProcedure example
T1003.001
LSASS Memory

OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

FireEye APT34 July 2019FireEye APT34 Webinar Dec 2017FireEye APT35 2018Unit42 OilRig Playbook 2023
T1003.004
LSA Secrets

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

FireEye APT34 July 2019FireEye APT34 Webinar Dec 2017FireEye APT35 2018Unit42 OilRig Playbook 2023
T1003.005
Cached Domain Credentials

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

FireEye APT34 July 2019FireEye APT34 Webinar Dec 2017FireEye APT35 2018Unit42 OilRig Playbook 2023
T1005
Data from Local System

OilRig has used PowerShell to upload files from compromised systems.

Trend Micro Earth Simnavaz October 2024
T1007
System Service Discovery

OilRig has used sc query on a victim to gather information about services.

Palo Alto OilRig May 2016
T1008
Fallback Channels

OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.

OilRig ISMAgent July 2017
T1012
Query Registry

OilRig has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.

Palo Alto OilRig May 2016
T1016
System Network Configuration Discovery

OilRig has run ipconfig /all on a victim.

Palo Alto OilRig May 2016Palo Alto OilRig Oct 2016
T1021.001
Remote Desktop Protocol

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.

Crowdstrike GTR2020 Mar 2020FireEye APT34 Webinar Dec 2017Symantec Crambus OCT 2023Unit42 OilRig Playbook 2023
T1021.004
SSH

OilRig has used Putty to access compromised systems.

Unit42 OilRig Playbook 2023
T1025
Data from Removable Media

OilRig has used Wireshark’s usbcapcmd utility to capture USB traffic.

Symantec Crambus OCT 2023
T1027.005
Indicator Removal from Tools

OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.

Palo Alto OilRig April 2017Unit42 OilRig Nov 2018
T1027.013
Encrypted/Encoded File

OilRig has encrypted and encoded data in its malware, including by using base64.

Crowdstrike Helix Kitten Nov 2018FireEye APT34 Dec 2017Unit 42 QUADAGENT July 2018Unit42 OilRig Nov 2018Unit42 OilRig Playbook 2023
T1033
System Owner/User Discovery

OilRig has run whoami on a victim.

Check Point APT34 April 2021Palo Alto OilRig May 2016Palo Alto OilRig Oct 2016
T1036
Masquerading

OilRig has used .doc file extensions to mask malicious executables.

Check Point APT34 April 2021

View all 76 procedure examples

Software30

BONDUPDATERcertutilftpHelminthipconfigISMInjectorLaZagneMangoMimikatzNetnetstatngrokODAgentOilBoosterOilCheckOopsIEPowerExchangePOWRUNERPsExecQUADAGENTRDATRegRGDoorSampleCheck5000
Show 6 more
SEASHARPEESideTwistSolarSysteminfoTasklistZeroCleare

Campaigns2

Juicy MixOuter Space

References7

  1. ClearSky OilRig Jan 2017 Open source
    ClearSky Cybersecurity. (2017, January 5). Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford. Retrieved May 3, 2017.
  2. FireEye APT34 Dec 2017 Open source
    Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  3. Palo Alto OilRig April 2017 Open source
    Falcone, R.. (2017, April 27). OilRig Actors Provide a Glimpse into Development and Testing Efforts. Retrieved May 3, 2017.
  4. Palo Alto OilRig May 2016 Open source
    Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  5. Palo Alto OilRig Oct 2016 Open source
    Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.
  6. Unit 42 QUADAGENT July 2018 Open source
    Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.
  7. Unit42 OilRig Playbook 2023 Open source
    Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.

© 2026 DetectionCode Website. All Rights Reserved.

Developed by Taher Gabr · LinkedIn