OilRig

Origin🇮🇷 Irã

Techniques (MITRE ATT&CK)76

SourceMITRE ATT&CK

State sponsor: Iran (Islamic Republic of)Attribution confidence: 50%Target categories: Government, Private sector, Civil society

Targeted regions: Israel · Kuwait · United States · Turkey · Saudi Arabia · Qatar · Lebanon · Middle East

Also known as:APT 34APT34ATK40COBALT GYPSYCobalt GypsyCrambusEUROPIUMEarth SimnavazEvasive SerpensG0049Hazel SandstormHelix KittenIRN2ITG13SOLAR IONTA452Twisted Kitten

About the group

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity74

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 76

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Email Accounts Malware Tool Code Signing Certificates Upload Malware

Initial access

Supply Chain Compromise Spearphishing Attachment Spearphishing Link Spearphishing via Service

Execution

Windows Management Instrumentation Scheduled Task Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Exploitation for Client Execution Malicious Link Malicious File

Persistence

External Remote Services Outlook Home Page Web Shell Windows Service

Privilege escalation

Exploitation for Privilege Escalation

Credential access

LSASS Memory LSA Secrets Cached Domain Credentials Brute Force Credentials In Files Credentials from Password Stores Credentials from Web Browsers Windows Credential Manager

Discovery

System Service Discovery Query Registry System Network Configuration Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Process Discovery Local Groups Domain Groups System Information Discovery Local Account Domain Account Peripheral Device Discovery Password Policy Discovery

Lateral movement

Remote Desktop Protocol SSH

Collection

Data from Local System Data from Removable Media Keylogging Screen Capture Clipboard Data Automated Collection

Command and control

Fallback Channels Web Protocols DNS Ingress Tool Transfer Remote Access Tools Protocol Tunneling Asymmetric Cryptography

Exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

defense-impairment

Modify Registry Code Signing Password Filter DLL Windows Host Firewall

stealth

Indicator Removal from Tools Encrypted/Encoded File Masquerading Match Legitimate Resource Name or Location File Deletion Valid Accounts Domain Accounts Deobfuscate/Decode Files or Information Compiled HTML File System Checks

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2024-30088HIGHEPSS 68%KEV MITRE ATT&CK

CVE-2017-11774HIGHEPSS 60%KEV MITRE ATT&CK

CVE-2017-8625EPSS 15% MITRE ATT&CK

References

OilRig uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →