Home / Threat actors / OilRig

OilRig G0049

🔔 Create alert

Also known as: COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

2

associated CVEs

91

Techniques

30

Malware and tools

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2024-30088 High · 7.0 KEV Ransomware Microsoft Windows Kernel TOCTOU Race Condition Vulnerability

“OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of `SYSTEM`.”

CVE-2017-11774 High · 7.8 KEV Microsoft Office Outlook Security Feature Bypass Vulnerability

“OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.”

Techniques by tactic

Resource Development

T1583.001 Domains T1586.002 Email Accounts T1587.001 Malware T1588.002 Tool T1588.003 Code Signing Certificates T1608.001 Upload Malware

Initial Access

T1078 Valid Accounts T1078.002 Domain Accounts T1133 External Remote Services T1195 Supply Chain Compromise T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1566.003 Spearphishing via Service

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File

Persistence

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts T1112 Modify Registry T1133 External Remote Services T1137.004 Outlook Home Page T1505.003 Web Shell T1543.003 Windows Service T1556.002 Password Filter DLL

Privilege Escalation

T1053.005 Scheduled Task T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.002 Domain Accounts T1543.003 Windows Service

Stealth

T1027.005 Indicator Removal from Tools T1027.013 Encrypted/Encoded File T1036 Masquerading T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1078 Valid Accounts T1078.002 Domain Accounts T1140 Deobfuscate/Decode Files or Information T1218.001 Compiled HTML File T1497.001 System Checks

Defense Impairment

T1112 Modify Registry T1553.002 Code Signing T1556.002 Password Filter DLL T1686.003 Windows Host Firewall

Credential Access

T1003.001 LSASS Memory T1003.004 LSA Secrets T1003.005 Cached Domain Credentials T1056.001 Keylogging T1110 Brute Force T1552.001 Credentials In Files T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers T1555.004 Windows Credential Manager T1556.002 Password Filter DLL

Discovery

T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.001 Local Groups T1069.002 Domain Groups T1082 System Information Discovery T1087.001 Local Account T1087.002 Domain Account T1120 Peripheral Device Discovery T1201 Password Policy Discovery T1497.001 System Checks

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.004 SSH

Collection

T1005 Data from Local System T1025 Data from Removable Media T1056.001 Keylogging T1113 Screen Capture T1115 Clipboard Data T1119 Automated Collection

Command and Control

T1008 Fallback Channels T1071.001 Web Protocols T1071.004 DNS T1105 Ingress Tool Transfer T1219 Remote Access Tools T1572 Protocol Tunneling T1573.002 Asymmetric Cryptography

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malware and tools

BONDUPDATERMalwareS0360
HelminthMalwareS0170
ISMInjectorMalwareS0189
MangoMalwareS1169
ODAgentMalwareS1170
OilBoosterMalwareS1172
OilCheckMalwareS1171
OopsIEMalwareS0264
PowerExchangeMalwareS1173
POWRUNERMalwareS0184
QUADAGENTMalwareS0269
RDATMalwareS0495
RGDoorMalwareS0258
SampleCheck5000MalwareS1168
SEASHARPEEMalwareS0185
SideTwistMalwareS0610
SolarMalwareS1166
ZeroCleareMalwareS1151
certutilToolS0160
ftpToolS0095
ipconfigToolS0100
LaZagneToolS0349
MimikatzToolS0002
NetToolS0039
netstatToolS0104
ngrokToolS0508
PsExecToolS0029
RegToolS0075
SysteminfoToolS0096
TasklistToolS0057

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.