OilRig

Threat actor

Attributed to Iran by MITRE ATT&CK (source). An attribution, not a proven fact.

Names and who uses them

OilRigOur name
IRN2CrowdStrike
EUROPIUMMicrosoft
Hazel SandstormMicrosoft
ITG13MITRE ATT&CK
APT34Palo Alto Networks
Evasive SerpensPalo Alto Networks
Helix KittenPalo Alto Networks
TA452Proofpoint
COBALT GYPSYSecureworks
CrambusSymantec
Earth SimnavazTrend Micro

Targets

Sectors: Government, Energy, Finance, Telecommunications, Chemical

Regions: Middle East

Source: MITRE ATT&CK

Known techniques

T1003.001LSASS Memory
T1003.004LSA Secrets
T1003.005Cached Domain Credentials
T1005Data from Local System
T1007System Service Discovery
T1008Fallback Channels
T1012Query Registry
T1016System Network Configuration Discovery
T1021.001Remote Desktop Protocol
T1021.004SSH
T1025Data from Removable Media
T1027.005Indicator Removal from Tools
T1027.013Encrypted/Encoded File
T1033System Owner/User Discovery
T1036Masquerading
T1036.005Match Legitimate Resource Name or Location
T1046Network Service Discovery
T1047Windows Management Instrumentation
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1049System Network Connections Discovery
T1053.005Scheduled Task
T1056.001Keylogging
T1057Process Discovery
T1059Command and Scripting Interpreter
T1059.001PowerShell
T1059.003Windows Command Shell
T1059.005Visual Basic
T1068Exploitation for Privilege Escalation
T1069.001Local Groups
T1069.002Domain Groups
T1070.004File Deletion
T1071.001Web Protocols
T1071.004DNS
T1078Valid Accounts
T1078.002Domain Accounts
T1082System Information Discovery
T1087.001Local Account
T1087.002Domain Account
T1105Ingress Tool Transfer
T1110Brute Force

Source: MITRE ATT&CK

Malware and tools used

Source: MITRE ATT&CK

Recent news

No stories yet.