OilRig (APT34) is a long-running Iranian state espionage group operating since at least 2014, specializing in Gulf-focused intrusions against government, energy, financial, and telecom targets, frequently via supply-chain and trust-relationship abuse.
OilRig has been publicly tracked since 2014 and is assessed to work on behalf of the Iranian government, with reporting most recently aligning it to the Ministry of Intelligence and Security (MOIS). Infrastructure details referencing Iran, the use of Iranian hosting, and consistently nation-state-aligned targeting underpin this attribution with high confidence.
The group is known for methodical, long-dwell espionage. It leans on spearphishing, web shells on internet-facing servers (notably Microsoft Exchange), custom backdoors, DNS-tunneling C2, and credential theft. A defining trait is supply-chain and trust-relationship abuse: compromising one organization to pivot into a higher-value primary target. Unit 42's published OilRig 'playbook' catalogues its extensive and evolving toolset.
MENA is OilRig's core theater. Victims cluster in Saudi Arabia, the UAE, Iraq, Jordan, Israel, Kuwait, and Qatar across government, energy, chemical, financial, and telecom sectors. Under the Trend Micro cluster name Earth Simnavaz, late-2024 reporting documented intrusions against UAE and Gulf-state government entities using a backdoor dubbed StealHook to siphon credentials from on-premises Exchange servers, chained with exploitation of a Windows kernel privilege-escalation vulnerability (CVE-2024-30088).
OilRig remained active through 2025, with reporting describing sustained intrusions against energy and defense organizations in Europe and the Middle East leveraging compromised Microsoft 365 accounts and Azure persistence — an assessed shift toward cloud-identity tradecraft. The group is one of the largest and most durable Iranian espionage actors still operating.
| Technique | Name | Tactic | Observed use |
|---|---|---|---|
| T1074.001 ↗ | Data Staged: Local Data Staging | collection | OilRig has used browser data and credential stealer tools to stage stolen files in %TEMP%. |
| T1025 ↗ | Data from Removable Media | collection | OilRig has used Wireshark's usbcapcmd utility to capture USB traffic. |
| T1115 ↗ | Clipboard Data | collection | OilRig has used infostealer tools to copy clipboard data. |
| T1005 ↗ | Data from Local System | collection | OilRig has used PowerShell to upload files from compromised systems. |
| T1113 ↗ | Screen Capture | collection | OilRig has a tool called CANDYKING to capture a screenshot of the user's desktop. |
| T1119 ↗ | Automated Collection | collection | OilRig has used automated collection. |
| T1573.002 ↗ | Encrypted Channel: Asymmetric Cryptography | command and control | OilRig has used the PowerExchange utility and other tools to create tunnels to C2. |
| T1105 ↗ | Ingress Tool Transfer | command and control | OilRig has downloaded remote files onto victim infrastructure. |
| T1008 ↗ | Fallback Channels | command and control | OilRig's malware ISMAgent falls back to its DNS tunneling if unable to reach C2 server over HTTP. |
| T1071.001 ↗ | Application Layer Protocol: Web Protocols | command and control | OilRig has used HTTP for C2, and has used HTTP to communicate between installed backdoors. |
| T1071.004 ↗ | Application Layer Protocol: DNS | command and control | OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service. |
| T1219 ↗ | Remote Access Tools | command and control | OilRig has incorporated remote monitoring and management tools including ngrok into operations. |
| T1572 ↗ | Protocol Tunneling | command and control | OilRig has used the Plink utility and other tools to create tunnels to C2 servers. |
| T1132.001 ↗ | Data Encoding: Standard Encoding | command and control | OilRig has used a VBS script to send the Base64-encoded name of the compromised computer. |
| T0869 ↗ | Standard Application Layer Protocol (ICS) | command and control (ICS) | OilRig communicated with command and control using HTTP requests. |
| T1555 ↗ | Credentials from Password Stores | credential access | OilRig has used credential dumping tools such as LaZagne to steal credentials. |
| T1555.003 ↗ | Credentials from Password Stores: Credentials from Web Browsers | credential access | OilRig has used credential dumping tools to steal credentials, and has used CDumper and EDumper. |
| T1555.004 ↗ | Credentials from Password Stores: Windows Credential Manager | credential access | OilRig has used a credential dumping tool named VALUEVAULT to steal credentials. |
| T1552.001 ↗ | Unsecured Credentials: Credentials In Files | credential access | OilRig has used credential dumping tools to steal credentials to accounts. |
| T1110 ↗ | Brute Force | credential access | OilRig has used brute force techniques to obtain credentials. |
| T1003.005 ↗ | OS Credential Dumping: Cached Domain Credentials | credential access | OilRig has used credential dumping tools such as LaZagne to steal credentials. |
| T1003.004 ↗ | OS Credential Dumping: LSA Secrets | credential access | OilRig has used credential dumping tools such as LaZagne to steal credentials. |
| T1003.001 ↗ | OS Credential Dumping: LSASS Memory | credential access | OilRig has used credential dumping tools such as Mimikatz to steal credentials. |
| T1056.001 ↗ | Input Capture: Keylogging | credential access, collection | OilRig has employed keyloggers including KEYPUNCH and LONGWATCH. |
| T1553.002 ↗ | Subvert Trust Controls: Code Signing | defense impairment | OilRig has signed its malware with stolen certificates. |
| T1686.003 ↗ | Disable or Modify System Firewall: Windows Host Firewall | defense impairment | OilRig has modified Windows firewall rules to enable remote access. |
| T1087.001 ↗ | Account Discovery: Local Account | discovery | OilRig has run net user, net user /domain, net group "domain admins" /domain, and related commands to enumerate accounts. |
| T1087.002 ↗ | Account Discovery: Domain Account | discovery | OilRig has run net user, net user /domain, net group "domain admins" /domain, and related commands to enumerate accounts. |
| T1217 ↗ | Browser Information Discovery | discovery | OilRig has used a Chrome data dumper named MKG, and has used CDumper and EDumper to collect cookies. |
| T1046 ↗ | Network Service Discovery | discovery | OilRig has used the publicly available tool SoftPerfect Network Scanner and custom tool GOLDIRONY. |
| T1120 ↗ | Peripheral Device Discovery | discovery | OilRig has used tools to identify if a mouse is connected to a targeted system. |
| T1069.001 ↗ | Permission Groups Discovery: Local Groups | discovery | OilRig has used net localgroup administrators to find local admins on systems. |
| T1069.002 ↗ | Permission Groups Discovery: Domain Groups | discovery | OilRig has used net group /domain, net group "domain admins" /domain, and related commands. |
| T1057 ↗ | Process Discovery | discovery | OilRig has run tasklist on a victim's machine and used infostealers to capture processes. |
| T1012 ↗ | Query Registry | discovery | OilRig has used reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client" on victim machines. |
| T1518 ↗ | Software Discovery | discovery | OilRig has used browser data dumper tools to create a list of users with Google Chrome. |
| T1082 ↗ | System Information Discovery | discovery | OilRig has run hostname and systeminfo on a victim machine. |
| T1016 ↗ | System Network Configuration Discovery | discovery | OilRig has run ipconfig /all on a victim machine. |
| T1049 ↗ | System Network Connections Discovery | discovery | OilRig has used netstat -an on a victim to get a listing of network connections. |
| T1007 ↗ | System Service Discovery | discovery | OilRig has used sc query on a victim to gather information about services. |
| T1033 ↗ | System Owner/User Discovery | discovery | OilRig has run whoami on a victim machine. |
| T1204.001 ↗ | User Execution: Malicious Link | execution | OilRig has delivered malicious links to achieve execution on the target system. |
| T1047 ↗ | Windows Management Instrumentation | execution | OilRig has used WMI for execution. |
| T1059.003 ↗ | Command and Scripting Interpreter: Windows Command Shell | execution | OilRig has used macros to deliver malware, and has used batch scripts. |
| T1059 ↗ | Command and Scripting Interpreter | execution | OilRig has used various types of scripting for execution. |
| T1059.005 ↗ | Command and Scripting Interpreter: Visual Basic | execution | OilRig has used VBScript macros for execution, and has used VBS droppers to deploy/deliver malware. |
| T1059.001 ↗ | Command and Scripting Interpreter: PowerShell | execution | OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command. |
| T1204.002 ↗ | User Execution: Malicious File | execution | OilRig has delivered macro-enabled documents requiring targets to click enable content. |
| T1201 ↗ | Password Policy Discovery | execution | OilRig has used net.exe in a script with net accounts /domain to find password policy. |
| T1203 ↗ | Exploitation for Client Execution | execution | OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of SYSTEM. |
| T0853 ↗ | Scripting (ICS) | execution (ICS) | OilRig embedded a macro with both a VBScript and a PowerShell script in emails. |
| T1053.005 ↗ | Scheduled Task/Job: Scheduled Task | execution, persistence, privilege escalation | OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines. |
| T1048.003 ↗ | Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol | exfiltration | OilRig has exfiltrated data via Microsoft Exchange and over FTP separately. |
| T1566.001 ↗ | Phishing: Spearphishing Attachment | initial access | OilRig has sent spearphishing emails with malicious attachments to potential victims. |
| T1566.002 ↗ | Phishing: Spearphishing Link | initial access | OilRig has sent spearphishing emails with malicious links to potential victims. |
| T1566.003 ↗ | Phishing: Spearphishing via Service | initial access | OilRig has used LinkedIn to send spearphishing links. |
| T1195 ↗ | Supply Chain Compromise | initial access | OilRig has leveraged compromised organizations to conduct supply chain attacks. |
| T0859 ↗ | Valid Accounts (ICS) | initial access (ICS) | OilRig utilized stolen credentials to gain access to victim machines. |
| T0817 ↗ | Drive-by Compromise (ICS) | initial access (ICS) | OilRig utilized watering hole attacks to collect credentials for ICS network access. |
| T0865 ↗ | Spearphishing Attachment (ICS) | initial access (ICS) | OilRig used spearphishing emails with malicious Microsoft Excel spreadsheet attachments. |
| T1133 ↗ | External Remote Services | initial access, persistence | OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment. |
| T1078.002 ↗ | Valid Accounts: Domain Accounts | initial access, persistence, privilege escalation, stealth | OilRig has used an exfiltration tool named STEALHOOK to retrieve valid domain credentials. |
| T1078 ↗ | Valid Accounts | initial access, persistence, privilege escalation, stealth | OilRig has used compromised credentials to access other systems on a victim network. |
| T1021.001 ↗ | Remote Services: Remote Desktop Protocol | lateral movement | OilRig has used Remote Desktop Protocol for lateral movement. |
| T1021.004 ↗ | Remote Services: SSH | lateral movement | OilRig has used Putty to access compromised systems. |
| T1137.004 ↗ | Office Application Startup: Outlook Home Page | persistence | OilRig has abused the Outlook Home Page feature for persistence. |
| T1505.003 ↗ | Server Software Component: Web Shell | persistence | OilRig has used web shells, often to maintain access to a victim network. |
| T1556.002 ↗ | Modify Authentication Process: Password Filter DLL | persistence, credential access, defense impairment | OilRig has registered a password filter DLL in order to drop malware. |
| T1112 ↗ | Modify Registry | persistence, defense impairment | OilRig has used reg.exe to modify system configuration. |
| T1543.003 ↗ | Create or Modify System Process: Windows Service | persistence, privilege escalation | OilRig has used a compromised Domain Controller to create a service on a remote host. |
| T1068 ↗ | Exploitation for Privilege Escalation | privilege escalation | OilRig has exploited the Windows Kernel Elevation of Privilege vulnerability CVE-2024-30088. |
| T1586.002 ↗ | Compromise Accounts: Email Accounts | resource development | OilRig has compromised email accounts to send phishing emails. |
| T1608.001 ↗ | Stage Capabilities: Upload Malware | resource development | OilRig has hosted malware on fake websites designed to target specific audiences. |
| T1583.001 ↗ | Acquire Infrastructure: Domains | resource development | OilRig has set up fake VPN portals, conference sign ups, and job application websites. |
| T1587.001 ↗ | Develop Capabilities: Malware | resource development | OilRig actively developed and used a series of downloaders during 2022. |
| T1584.004 ↗ | Compromise Infrastructure: Server | resource development | OilRig has compromised an Israeli human resources site to use as a C2 server. |
| T1588.003 ↗ | Obtain Capabilities: Code Signing Certificates | resource development | OilRig has obtained stolen code signing certificates to digitally sign malware. |
| T1585.003 ↗ | Establish Accounts: Cloud Accounts | resource development | OilRig has created M365 email accounts to be used as part of C2. |
| T1588.002 ↗ | Obtain Capabilities: Tool | resource development | OilRig has made use of publicly available tools including Plink and Mimikatz. |
| T1027.013 ↗ | Obfuscated Files or Information: Encrypted/Encoded File | stealth | OilRig has encrypted and encoded data in malware, including by using base64. |
| T1218.001 ↗ | System Binary Proxy Execution: Compiled HTML File | stealth | OilRig has used a CHM payload to load and execute another malicious file. |
| T1036 ↗ | Masquerading | stealth | OilRig has used .doc file extensions to mask malicious executables. |
| T1036.005 ↗ | Masquerading: Match Legitimate Resource Name or Location | stealth | OilRig has named a downloaded copy of the Plink tunneling utility as \ProgramData\Adobe.exe. |
| T1140 ↗ | Deobfuscate/Decode Files or Information | stealth | An OilRig macro has run a PowerShell command to decode file contents, and OilRig has used certutil to decode base64-encoded files. |
| T1070.004 ↗ | Indicator Removal: File Deletion | stealth | OilRig has deleted files associated with their payload after execution. |
| T1027.005 ↗ | Obfuscated Files or Information: Indicator Removal from Tools | stealth | OilRig has tested malware samples to determine AV detection and subsequently modified samples. |
| T1497.001 ↗ | Virtualization/Sandbox Evasion: System Checks | stealth, discovery | OilRig has used macros to verify if a mouse is connected to a compromised machine. |
OSINT feed items linking this actor. Latest Intel →