OilRig (APT34) · APT / State-sponsored · RaqibCTI

Knowledge/Actors/OilRig (APT34)Corpus

+ Request intel workspace

apt

OilRig (APT34)

active · last signal 2mo agoAttribution: HighWell-corroborated — multiple independent sources or primary reporting.

APT / State-sponsored

APT34Helix KittenCOBALT GYPSYEvasive SerpensHazel SandstormEUROPIUMEarth SimnavazCrambusIRN2ITG13TA452

Attribution

Iran — Ministry of Intelligence and Security (MOIS)

Origin

Iran

First seen

2014

Last active

2025

Motivation

Espionage

Attribution confidence

high

MENA targeting

Saudi Arabia, UAE, Iraq, Jordan, Israel, Kuwait, Qatar

Sectors

Government, financial, energy, chemical, telecom

MITRE ATT&CK

Corpus activity · 6mo1 mention

AMJJAS

Why it mattersState-sponsored / APT actor, high confidence, documented targeting Saudi Arabia, UAE, Iraq (Government, financial, energy sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

No open hunts or recent alerts tracked against this actor right now.

Associated with

Attributed to

Juicy MixATT&CK campaignATT&CK Campaign2022-01-01
Outer SpaceATT&CK campaignATT&CK Campaign2021-01-01

Related to

APT39 / ChaferactorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
MuddyWateractorTechnique overlap
APT33actorTechnique overlap
Tropic TrooperactorTechnique overlap
HEXANE (Lyceum)actor

Overview Attribution² TTPs⁸⁷ Indicators Reporting⁴ Coverage

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Technique overlap

←Cl0pactorTechnique overlap

←Fox KittenactorTechnique overlap

←Charming Kitten / APT42actorTechnique overlap

→Qilin (fka Agenda)actorTechnique overlap

→WIRTEactorTechnique overlap

→Void Manticore (Storm-0842)actorTechnique overlap

→SideWinderactorTechnique overlap

←BahamutactorTechnique overlap

→Stealth FalconactorTechnique overlap

←Agrius (Agonizing Serpens / BlackShadow)actorTechnique overlap

←Gaza Cybergang / MoleratsactorTechnique overlap

←Dust SpecteractorTechnique overlap

←Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap

←Nemesis KittenactorTechnique overlap

←LockBit / LockBit 3.0actorTechnique overlap

→Scarred Manticore (Storm-0861)actorTechnique overlap

→RansomHubactorTechnique overlap

←MedusaactorTechnique overlap

←Earth BogleactorTechnique overlap

→UNC1860actorTechnique overlap

←Dark CaracalactorTechnique overlap

←BladedFelineactorTechnique overlap

←Imperial Kitten (CURIUM)actorTechnique overlap

←Flame / FlameractorTechnique overlap

→Sea TurtleactorTechnique overlap

←Infy / Prince of PersiaactorTechnique overlap

→UNC215actorTechnique overlap

→WarlockactorTechnique overlap

←ALPHV / BlackCatactorTechnique overlap

←Crypto24actorTechnique overlap

←BellaCiao operators (Charming Kitten-linked)actorTechnique overlap

←LynxactorTechnique overlap

+127 more relationships — see the relationships browser.

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

ActorCleaver
ActorAPT33
ActorMuddyWater
ActorAPT39 / Chafer
ActorCavern Manticore
ActorInfy / Prince of Persia

Suggested · co-occurring (unverified)

These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.

TechniqueT1574.002co-mentioned in 1 item
SectorGovernmentco-mentioned in 1 item
MalwareCavern frameworkco-mentioned in 1 item
Malwaren-HTCommp.dllco-mentioned in 1 item
CountryIsraelco-mentioned in 1 item
SectorIT providersco-mentioned in 1 item
MalwareCavern Agentco-mentioned in 1 item
TechniqueT1071co-mentioned in 1 item