Earth Simnavaz

Earth Simnavaz is Trend Micro's designation for the Iranian MOIS-linked threat cluster known as OilRig and APT34. Trend Micro documented Earth Simnavaz conducting cyberespionage operations against government and critical infrastructure organizations in the UAE and Gulf region, using Exchange server exploitation and a novel backdoor that abuses the Windows IIS server for command and control. Earth Simnavaz operations show the group's continued capability development and persistent focus on Gulf state government targets consistent with the broader OilRig cluster's MOIS-attributed mission.