OilRig (G0049) | Threat Actor Index

About OilRig

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.

View MITRE record ↗

Techniques by Tactic (76)

Resource Development

T1583.001 DomainsT1586.002 Email AccountsT1587.001 MalwareT1588.002 ToolT1588.003 Code Signing CertificatesT1608.001 Upload Malware

Initial Access

T1078 Valid AccountsT1078.002 Domain AccountsT1133 External Remote ServicesT1195 Supply Chain CompromiseT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1566.003 Spearphishing via Service

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious File

Persistence

T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain AccountsT1112 Modify RegistryT1133 External Remote ServicesT1137.004 Outlook Home PageT1505.003 Web ShellT1543.003 Windows ServiceT1556.002 Password Filter DLL

Privilege Escalation

T1053.005 Scheduled TaskT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.002 Domain AccountsT1543.003 Windows Service

Stealth

T1027.005 Indicator Removal from ToolsT1027.013 Encrypted/Encoded FileT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1078 Valid AccountsT1078.002 Domain AccountsT1140 Deobfuscate/Decode Files or InformationT1218.001 Compiled HTML FileT1497.001 System Checks

Defence Impairment

T1112 Modify RegistryT1553.002 Code SigningT1556.002 Password Filter DLLT1686.003 Windows Host Firewall

Credential Access

T1003.001 LSASS MemoryT1003.004 LSA SecretsT1003.005 Cached Domain CredentialsT1056.001 KeyloggingT1110 Brute ForceT1552.001 Credentials In FilesT1555 Credentials from Password StoresT1555.003 Credentials from Web BrowsersT1555.004 Windows Credential ManagerT1556.002 Password Filter DLL

Discovery

T1007 System Service DiscoveryT1012 Query RegistryT1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1069.001 Local GroupsT1069.002 Domain GroupsT1082 System Information DiscoveryT1087.001 Local AccountT1087.002 Domain AccountT1120 Peripheral Device DiscoveryT1201 Password Policy DiscoveryT1497.001 System Checks

Lateral Movement

T1021.001 Remote Desktop ProtocolT1021.004 SSH

Collection

T1005 Data from Local SystemT1025 Data from Removable MediaT1056.001 KeyloggingT1113 Screen CaptureT1115 Clipboard DataT1119 Automated Collection

Command & Control

T1008 Fallback ChannelsT1071.001 Web ProtocolsT1071.004 DNST1105 Ingress Tool TransferT1219 Remote Access ToolsT1572 Protocol TunnelingT1573.002 Asymmetric Cryptography

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Toolsets (30)

🐛

BONDUPDATER S0360

Malware · Windows

🐛

Helminth S0170

Malware · Windows

🐛

ISMInjector S0189

Malware · Windows

🐛

Mango S1169

Malware · Windows

🐛

ODAgent S1170

Malware · Windows

🐛

OilBooster S1172

Malware · Windows

🐛

OilCheck S1171

Malware · Windows

🐛

OopsIE S0264

Malware · Windows

🐛

POWRUNER S0184

Malware · Windows

🐛

PowerExchange S1173

Malware · Windows

🐛

QUADAGENT S0269

Malware · Windows

🐛

RDAT S0495

Malware · Windows

🐛

RGDoor S0258

Malware · Windows

🐛

SEASHARPEE S0185

Malware · Windows

🐛

SampleCheck5000 S1168

Malware · Windows

🐛

SideTwist S0610

Malware · Windows

🐛

Solar S1166

Malware · Windows

🐛

ZeroCleare S1151

Malware · Windows

🔧

LaZagne S0349

Tool · Linux, macOS, Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

PsExec S0029

Tool · Windows

🔧

Reg S0075

Tool · Windows

🔧

Systeminfo S0096

Tool

🔧

Tasklist S0057

Tool

🔧

certutil S0160

Tool · Windows

🔧

ftp S0095

Tool · Linux, Windows, macOS

🔧

ipconfig S0100

Tool

🔧

netstat S0104

Tool

🔧

ngrok S0508

Tool · Windows

CVEs Referenced (1)

CVE-2017-8625View full details on NVD

References & Reports (16)