Actors Insights|Latest update29/07/2026

OilRig

Named by Palo AltoSuspected state sponsor: Islamic Republic of Iran

OilRig is an Iranian MOIS-linked threat cluster active since at least 2014, considered one of Iran's most technically capable and consistently active espionage groups. The cluster targets government, energy, financial, and telecommunications organizations across the Middle East and beyond, using spear phishing, credential harvesting portals, DNS tunneling, and a large arsenal of custom backdoors including HELMINTH, BONDUPDATER, VEATY, and SPEARAL. OilRig is tracked as APT34 (Mandiant), Helix Kitten (CrowdStrike), Cobalt Gypsy (Secureworks), and Hazel Sandstorm (Microsoft) among other names.

First Seen:Jul 2015
Last Seen:May 2026
Indexed Reports:32
Public IOCs:543
Cluster: OilRigMitre: OilRigMisp: CHRYSENE
also known as:
OilRig (Palo Alto)Greenbug (Symantec)Chrysene (Dragos)COBALT GYPSY (SecureWorks)IRN2 (Area 1)APT34 (Mandiant)Helix Kitten (CrowdStrike)Evasive SerpensHazel Sandstorm (Microsoft)EUROPIUM (Microsoft)ITG13 (IBM)Earth Simnavaz (Trend Micro)Crambus (Symantec)TA452 (Proofpoint)G0049 (Mitre)APT-C-49

Targeted Regions

Albania
AL
Albania
Albania
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Bahrain
BH
Bahrain
Bahrain
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Sep 2019 ~ Sep 2019
Cambodia
KH
Cambodia
Cambodia
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
China
CN
China
China
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Egypt
EG
Egypt
Egypt
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Europe
EU
Europe
Europe
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Dec 2025 ~ Apr 2026
Dec 2025 ~ Apr 2026
Hong Kong
HK
Hong Kong
Hong Kong
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Iran
IR
Iran
Iran
Jul 2018 ~ Sep 2018
Jul 2018 ~ Sep 2018
Iraq
IQ
Iraq
Iraq
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Israel
IL
Israel
Israel
Jun 2016 ~ Sep 2017
Oct 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Nov 2016 ~ Jan 2017
Sep 2016 ~ Oct 2016
Oct 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Apr 2017 ~ Apr 2017
Nov 2016 ~ Jan 2017
Oct 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Feb 2021 ~ Sep 2023
Nov 2021 ~ Dec 2023
Feb 2021 ~ Sep 2023
Nov 2021 ~ Dec 2023
Feb 2021 ~ Sep 2023
Nov 2021 ~ Dec 2023
Feb 2021 ~ Sep 2023
Nov 2021 ~ Dec 2023
Feb 2021 ~ Sep 2023
Nov 2021 ~ Dec 2023
Feb 2021 ~ Sep 2023
Jordan
JO
Jordan
Jordan
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Kazakhstan
KZ
Kazakhstan
Kazakhstan
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Kuwait
KW
Kuwait
Kuwait
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Lebanon
LB
Lebanon
Lebanon
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Macau
MO
Macau
Macau
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Mexico
MX
Mexico
Mexico
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Middle East
ME
Middle East
Middle East
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
May 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2016 ~ Apr 2019
Sep 2016 ~ Jul 2017
May 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2016 ~ Apr 2019
Sep 2016 ~ Jul 2017
May 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2017 ~ Jul 2020
Oct 2016 ~ Apr 2019
Sep 2016 ~ Jul 2017
May 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2017 ~ Jul 2020
Oct 2016 ~ Apr 2019
May 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Jan 2018 ~ Jan 2018
Jan 2018 ~ Feb 2018
May 2018 ~ Jul 2018
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2017 ~ Jul 2020
Oct 2016 ~ Apr 2019
May 2016 ~ Apr 2019
Aug 2018 ~ Nov 2018
Jul 2018 ~ Sep 2018
Aug 2018 ~ Sep 2018
May 2018 ~ Jul 2018
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2017 ~ Jul 2020
Oct 2016 ~ Apr 2019
May 2016 ~ Apr 2019
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2017 ~ Jul 2020
Jan 2020 ~ Jul 2022
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2017 ~ Jul 2020
Jan 2020 ~ Jul 2022
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2017 ~ Jul 2020
Jan 2020 ~ Jul 2022
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2020 ~ Jul 2022
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2020 ~ Jul 2022
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2020 ~ Jul 2022
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2020 ~ Jul 2022
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Dec 2025 ~ Apr 2026
Dec 2025 ~ Apr 2026
Mongolia
MN
Mongolia
Mongolia
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Nigeria
NG
Nigeria
Nigeria
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oman
OM
Oman
Oman
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Palestine
PS
Palestine
Palestine
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Qatar
QA
Qatar
Qatar
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Sep 2016 ~ Oct 2016
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2016 ~ Apr 2019
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jul 2015 ~ May 2016
Jan 2016 ~ Jan 2025
Jul 2015 ~ May 2016
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
May 2016 ~ Apr 2019
Jul 2015 ~ May 2016
Jun 2016 ~ Sep 2017
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2016 ~ Apr 2019
May 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Nov 2016 ~ Jan 2017
Sep 2016 ~ Oct 2016
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2016 ~ Apr 2019
May 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Nov 2016 ~ Jan 2017
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2016 ~ Apr 2019
May 2016 ~ Apr 2019
Jun 2016 ~ Sep 2017
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2016 ~ Apr 2019
May 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2016 ~ Apr 2019
May 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Oct 2016 ~ Apr 2019
May 2016 ~ Apr 2019
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
Jun 2016 ~ Dec 2024
Jan 2016 ~ Jan 2025
South Korea
KR
South Korea
South Korea
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Taiwan
TW
Taiwan
Taiwan
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Thailand
TH
Thailand
Thailand
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Sep 2024 ~ Mar 2026
Sep 2024 ~ Mar 2026
Sep 2024 ~ Mar 2026
Sep 2024 ~ Mar 2026
Turkey
TR
Turkey
Turkey
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Sep 2016 ~ Oct 2016
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Oct 2016 ~ Apr 2019
Nov 2016 ~ Jan 2017
Oct 2017 ~ Jul 2020
Oct 2016 ~ Apr 2019
Aug 2017 ~ Oct 2017
Oct 2017 ~ Jul 2020
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2017 ~ Jul 2020
Oct 2016 ~ Apr 2019
Jul 2018 ~ Sep 2018
Oct 2017 ~ Jul 2020
Oct 2016 ~ Apr 2019
Oct 2017 ~ Jul 2020
Oct 2017 ~ Jul 2020
Oct 2017 ~ Jul 2020
United States
US
United States
United States
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Sep 2016 ~ Oct 2016
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Jan 2016 ~ Jan 2025
Dec 2025 ~ Apr 2026
Dec 2025 ~ Apr 2026
Yemen
YE
Yemen
Yemen
Jul 2018 ~ Sep 2018
Jul 2018 ~ Sep 2018
Zimbabwe
ZW
Zimbabwe
Zimbabwe
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Oct 2016 ~ Apr 2019
Jan 2015Jul 2026

Targeted Sectors

Government Agencies and ServicesInformation TechnologyTelecommunicationFinancialEnergyUtilitiesUniversityDefenseOil and GasManufacturingLogisticsHealthcareEducationDissidentHuman RightsMediaTransportationMedicalProfessional ServiceConsultingReal EstateScientific ResearchHigh-TechInsurance

Recent Indexed Reports

  1. Public
    Multi-Stage Attack Chain: How OilRig Targets Global Sectors Using Telegram and Google Drive
  2. Public
    OilRig Supply Chain Attack: Stolen Thai IT Vendor Certificates Hide Karkoff Backdoor
  3. Public
    OilRig: Cyber-Espionage Targeting Global Critical Sectors
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.