Início / Grupos de ameaça / OilRig

OilRig G0049

🔔 Criar alerta

Também conhecido como: COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

2

CVEs associadas

91

Técnicas

30

Malwares e ferramentas

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2024-30088 Alta · 7.0 KEV Ransomware Microsoft Windows Kernel TOCTOU Race Condition Vulnerability

“OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of `SYSTEM`.”

CVE-2017-11774 Alta · 7.8 KEV Microsoft Office Outlook Security Feature Bypass Vulnerability

“OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.”

Técnicas por tática

Desenvolvimento de recursos

T1583.001 Domains T1586.002 Email Accounts T1587.001 Malware T1588.002 Tool T1588.003 Code Signing Certificates T1608.001 Upload Malware

Acesso inicial

T1078 Valid Accounts T1078.002 Domain Accounts T1133 External Remote Services T1195 Supply Chain Compromise T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1566.003 Spearphishing via Service

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File

Persistência

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts T1112 Modify Registry T1133 External Remote Services T1137.004 Outlook Home Page T1505.003 Web Shell T1543.003 Windows Service T1556.002 Password Filter DLL

Escalada de privilégios

T1053.005 Scheduled Task T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.002 Domain Accounts T1543.003 Windows Service

Furtividade

T1027.005 Indicator Removal from Tools T1027.013 Encrypted/Encoded File T1036 Masquerading T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1078 Valid Accounts T1078.002 Domain Accounts T1140 Deobfuscate/Decode Files or Information T1218.001 Compiled HTML File T1497.001 System Checks

Comprometimento de defesas

T1112 Modify Registry T1553.002 Code Signing T1556.002 Password Filter DLL T1686.003 Windows Host Firewall

Acesso a credenciais

T1003.001 LSASS Memory T1003.004 LSA Secrets T1003.005 Cached Domain Credentials T1056.001 Keylogging T1110 Brute Force T1552.001 Credentials In Files T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers T1555.004 Windows Credential Manager T1556.002 Password Filter DLL

Descoberta

T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.001 Local Groups T1069.002 Domain Groups T1082 System Information Discovery T1087.001 Local Account T1087.002 Domain Account T1120 Peripheral Device Discovery T1201 Password Policy Discovery T1497.001 System Checks

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.004 SSH

Coleta

T1005 Data from Local System T1025 Data from Removable Media T1056.001 Keylogging T1113 Screen Capture T1115 Clipboard Data T1119 Automated Collection

Comando e controle

T1008 Fallback Channels T1071.001 Web Protocols T1071.004 DNS T1105 Ingress Tool Transfer T1219 Remote Access Tools T1572 Protocol Tunneling T1573.002 Asymmetric Cryptography

Exfiltração

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malwares e ferramentas

BONDUPDATERMalwareS0360
HelminthMalwareS0170
ISMInjectorMalwareS0189
MangoMalwareS1169
ODAgentMalwareS1170
OilBoosterMalwareS1172
OilCheckMalwareS1171
OopsIEMalwareS0264
PowerExchangeMalwareS1173
POWRUNERMalwareS0184
QUADAGENTMalwareS0269
RDATMalwareS0495
RGDoorMalwareS0258
SampleCheck5000MalwareS1168
SEASHARPEEMalwareS0185
SideTwistMalwareS0610
SolarMalwareS1166
ZeroCleareMalwareS1151
certutilFerramentaS0160
ftpFerramentaS0095
ipconfigFerramentaS0100
LaZagneFerramentaS0349
MimikatzFerramentaS0002
NetFerramentaS0039
netstatFerramentaS0104
ngrokFerramentaS0508
PsExecFerramentaS0029
RegFerramentaS0075
SysteminfoFerramentaS0096
TasklistFerramentaS0057

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.