- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored, Ministry of Intelligence and Security (MOIS)
- Agency named
- MOIS, Ministry of Intelligence
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2014–2026
- Status
- Active
- ATT&CK
- G0049 · 82 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0049 · oilrig
IranWhat it is
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Greenbug, Volatile Kitten, Helix Kitten, Twisted Kitten, Volatile Kitten
- IBM X-Force
- ITG13
- Mandiant
- APT34, UNC1860, APT 34
- Microsoft
- Hazel Sandstorm, DEV-0861, Storm-0861
- MITRE ATT&CK
- G0049
- Proofpoint
- TA452
- Secureworks
- COBALT GYPSY
- Thales
- ATK40
- Trend Micro
- Earth Simnavaz
- Other names
- CHRYSENE, Greenbug, Scarred Manticore, ATK 40, Crambus, EUROPIUM, Evasive Serpens, IRN2, OilRig, APT 34, Helix Kitten, Chrysene, SOLAR ION, Yellow Maero
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Albania, Azerbaijan, Bahrain, China, Egypt, Iraq, Israel, Jordan, Kuwait, Lebanon, Mauritius, Middle East, Oman, Pakistan, Qatar, Saudi Arabia, Türkiye, United Arab Emirates, United Kingdom, United States
- Sectors
- Aerospace, Aviation, Chemical, Civil society, Defense, Education, Energy, Engineering, Finance, Financial, Government, Government, Administration, High-Tech, Hospitality, Investment, IT, Oil and gas, Other, Private sector, Telecommunications, Telecoms
Tools
The tools and malware families the sources tie to it.
- BONDUPDATER
- Backdoor.Oldrea
- Cyber Eye RAT
- CyberGate
- DesktopNow
- Helminth
- ISMInjector
- LaZagne
- Mango
- Mimikatz
- Net
- ODAgent
- OilBooster
- OilCheck
- OopsIE
- POWRUNER
- PowerExchange
- PsExec
- QUADAGENT
- RDAT
- RGDoor
- Reg
- Remote Utilities
- RemoteCMD
- RemotePC
- SEASHARPEE
- SPACESHIP
- SampleCheck5000
- SideTwist
- Solar
- Systeminfo
- Tasklist
- Windows Remote Desktop
- Xploit
- ZeroCleare
- certutil
- ftp
- ipconfig
- netstat
- ngrok
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de