Threats Feed

OilRig targeted a telecommunications organization in the Middle East using a variant of their RDAT tool, featuring a novel email-based command and control (C2) channel that employs steganography. This method hides commands and data within bitmap images attached to emails, making detection difficult. The attack involved custom Mimikatz tools for credential dumping, Bitvise for SSH tunneling, and PowerShell downloaders. RDAT has been under development since 2017, evolving to include DNS tunneling and Exchange Web Services (EWS) for C2 communications. The use of steganographic images in emails represents a sophisticated evasion technique.

Iranian APT groups APT34 and APT33 jointly operated the Fox Kitten campaign from 2017 to 2019, exploiting VPN vulnerabilities (e.g., Pulse Secure CVE-2019-11510, Fortinet CVE-2018-13379) to breach networks across Israel, the US, Gulf states, and Europe. Targeted sectors included IT, telecommunications, oil and gas, aviation, government, and security. The attackers established persistence using custom and open-source tools, including SSH tunnels, RDP proxies, webshells, and credential dumping via Mimikatz and ProcDump. Tools like Ngrok and Serveo enabled data exfiltration. The infrastructure supported both espionage and potential destructive operations tied to malware such as ZeroCleare and Dustman.

APT34 has launched a new campaign targeting United States-based research services company Westat, and its customers, employing a modified toolset. The attack was discovered in late January 2020 and initiated with a spear-phishing operation using a disguised employee satisfaction survey file, survey.xls. Once the victim enabled macros, malicious VBA code executed, extracting and installing a more advanced and stealthy variant of the TONEDEAF malware, TONEDEAF 2.0. The attackers also possibly used a VALUEVAULT implant for browser credential theft. The effort demonstrates APT34's substantial investment in upgrading its toolset to evade future detection.

Kaspersky's December 2019 report analyzes Poison Frog, a PowerShell-based backdoor used by OilRig (APT34) discovered after scanning archives with a custom YARA rule. The earliest samples date to July 2017, with the malware named after its C2 domain poison-frog[.]club. Each sample is a PE32 executable written in C# that drops an embedded PowerShell script containing two backdoor agents — an HTTP backdoor (59 lines) and a DNS backdoor (335 lines) — and deletes the dropper after execution. The HTTP agent generates a UID from the MAC address or whoami output, then beacons to the C2 to receive commands: execute a shell command and return output, check for and upload a file, or receive and save a file to disk. The DNS agent supports the same command execution and file transfer functions. Persistence is achieved via Windows Task Scheduler. To improve delivery odds, OilRig disguised the malware as a legitimate Cisco AnyConnect VPN application, though implementation errors were present — including a popup appearing on every click and a typo rendering one sample non-functional ("Poweeershell.exe"). Other sloppiness included PDB paths left in binaries and tampered compilation timestamps set to future dates. No specific targeted sectors or countries are named in this report.

IBM's X-Force team has detailed a new destructive malware, ZeroCleare, targeting the energy sector in the Middle East. The wiper, similar to Shamoon, overwrites data and maliciously uses legitimate tools. Attribution points to Iranian state-sponsored groups, possibly a collaboration between ITG13 and another entity. The report highlights the increase in destructive attacks, particularly in the energy sector, and offers mitigation strategies, including the use of threat intelligence, robust security controls and effective backup systems. Finally, it notes the wider geopolitical implications of such attacks.

This NSFOCUS report details an analysis of a leaked toolkit belonging to the APT34 hacking group, also known for its similarities to OilRig. The report focuses on the toolkit's components, including Trojans such as Glimpse and PoisonFrog, and Webshells used for privilege escalation and data exfiltration, primarily targeting the energy and financial sectors, particularly in China and the Middle East. The analysis details the functionality and communication methods of the tools, which use DNS tunneling for command and control.

The IronNet Threat Research team explored PoisonFrog malware, revealing its DNS tunneling capabilities for covert communications. This PowerShell-based malware, linked to the OilRig/APT34 group, abuses DNS protocol to establish command and control channels, avoiding direct malicious infrastructure connections. PoisonFrog crafts DNS queries to register, receive tasks, and transmit data, leveraging recursion for seamless integration into victims' DNS infrastructures. Despite its sophisticated DNS usage, PoisonFrog includes an HTTP fallback for command and control, indicating preparedness for DNS communication failure.

NETSCOUT ASERT captured live command and control traffic from an updated BONDUPDATER variant targeting the Office of the First Deputy Prime Minister of Bahrain via spearphishing emails — activity the team attributes to OilRig (APT34). ASERT reverse-engineered the malware's C2 protocol in real time, documenting two key mechanisms. Command delivery uses DNS TXT records: the attacker's nameserver returns base64-encoded commands (with modified padding characters) in a structured format prefixed by a 5-character identifier and delimited by a ">" character, allowing multi-part commands to be reassembled on the victim machine. Data exfiltration uses DNS A record queries, with output stuffed into custom subdomains using a distinctive nibble-splitting obfuscation technique: each byte of data is split into its two 4-bit nibbles, with first nibbles placed in one list and second nibbles in another, joined end-to-end to form subdomain strings. Exfiltration sessions are bracketed by "COCTab" (start) and "COCTabCOCT" (end) markers in the subdomain, alongside a command identification value allowing the attacker to map responses to issued commands. ASERT observed the attacker running whoami and ipconfig /all as initial reconnaissance commands. The C2 domain used was withyourface[.]com. NETSCOUT notes that BONDUPDATER's continuous development — including this new obfuscation layer — indicates OilRig's ongoing investment in evading detection, and recommends monitoring DNS traffic for abnormally long domain names and scanning DNS A record subdomains for the "COCTab" string as a specific detection indicator.

The Ismdoor malware, linked with the GreenBug group, continues its cyberattacks using DNS tunneling to evade detection, communicate with command and control servers, and exfiltrate data. Black Lotus Labs detected recent spikes in such activities related to the domain basnevs[.]com, associated with Ismdoor. The malware uses encoded subdomains for data exfiltration and receives hex-encoded messages from the C2. An increase in tunneling activity suggests that too many organizations still allow unmonitored DNS traffic, which amplifies the risk of successful DNS tunneling attacks. The report doesn't explicitly mention specific targeted countries or sectors.

Mandiant detected a phishing campaign by APT34, an Iranian-nexus threat actor, in late June 2019. The actor, posing as a member of Cambridge University, delivered malicious documents via LinkedIn and introduced three new malware families. The primary industries targeted by this campaign were Energy and Utilities, Government, and Oil and Gas. APT34 is notably active in the Middle East, employing a blend of public and non-public tools to carry out its cyber espionage activities.

The OilRig group has been actively targeting various sectors, including government, media, energy, and technology across 27 countries. The group has stolen nearly 13,000 credentials, deployed over 100 webshells, and maintained backdoor access to compromised hosts. Techniques include credential dumping with Mimikatz, DNS hijacking, and using PowerShell-based tools like Glimpse and Poison Frog. Their operations involve SQL injections, exploiting public-facing applications, and leveraging webshells for persistent access. The group's sophisticated TTPs underline their persistent threat to diverse industry verticals.

The APT34/OILRIG group, linked to Iranian intelligence, had its operational details leaked by the "Lab Dookhtegan" group on Telegram. The leaks revealed a C2 infrastructure, PowerShell-based agents, ASP web shells ("HighShell" and "HyperShell"), and a DNS-based espionage toolset ("dnspionage"). These tools facilitate file transfer, credential theft and covert communication via proxies and DNS manipulation. The attackers also collected sensitive data, including domain admin credentials, indicating a potential target for high-value networks. While specific sectors or countries are not detailed, the tools suggest a focus on espionage and disruption. Other tools, such as 'MinionProject' and 'FoxPanel222', remain under analysis.

The report highlights OilRig’s deployment of tools like Helminth, ISMAgent, ALMACommunicator, BONDUPDATER, and QUADAGENT, which utilize DNS queries to communicate stealthily with C2 servers. This covert communication method is favored due to DNS's typical allowance through security devices. The group has evolved its DNS tunneling protocols over time, using customized subdomains and encoding techniques to transmit data and evade detection effectively.

Palo Alto Unit42 provides unique insight into OilRig's pre-attack operational tempo by reconstructing a 6-day testing timeline that preceded the August 26, 2018 BONDUPDATER attack on a Middle Eastern government. By analyzing 11 test Excel documents submitted to public VirusTotal-style scanning services between August 20–26, Unit42 mapped every iterative macro change the attacker made to lower AV detection rates — from 22 detections on the first submission down to 7 on the last, with a rebound to 38 on the final weaponized Word document (N56.15.doc). The test files were named XLS-withyourface.xls and sss.xls, with the C2 domain (withyourface[.]com) embedded directly in the early filenames, linking them conclusively to the BONDUPDATER attack. The tester averaged 33 seconds between file save and VirusTotal submission, conducted three testing waves, and pivoted from Excel to Word for the final delivery document. Key technical lessons the attacker applied: removing the "powershell.exe" string from VBScript lowered detections from 22 to 16; removing the wscript execution call dropped detections from 16 to 6; using vbHide (hidden window) flag caused 8 additional detections compared to vbNormalFocus (visible window); and hex-character concatenation obfuscation of "powershell", "cmd.exe", and "wscript" strings bypassed most detections. The final weaponized Word document was created less than 8 hours after the last test iteration and delivered via spearphishing 20 minutes after its creation, setting a precise operational tempo. OilRig also added a 10-second sleep using Application.Wait during some testing iterations as an anti-sandbox technique, though this was removed in the final payload.

The OilRig group has continued its cyber attacks, mainly in the Middle East. The group targeted governmental organizations using spear-phishing emails, delivering an updated Trojan known as BONDUPDATER. The Trojan allows threat actors to upload and download files, execute commands, and uses DNS tunneling for C2 communications. It also employs a new technique of DNS tunneling protocol via DNS TXT records. The continued onslaught of OilRig attacks into 2018 is of concern, with variations of previous tools being reused, capitalizing on their prior success.

Palo Alto Unit42 documents an evolved OopsIE variant deployed by OilRig against a Middle Eastern government agency in mid-2018, adding nine anti-analysis and anti-VM checks to an otherwise functionally similar trojan. The spearphishing email used an Arabic subject line ("Business continuity management training") sent to a group email address whose members had publicly published documents on that topic — indicating deliberate target research. The nine evasion checks (executed before any functional code runs) query for: CPU fan presence (Win32_Fan WMI — novel at time of publication), CPU temperature (MSAcpi_ThermalZoneTemperature — also seen in GravityRAT), mouse pointer manufacturer strings (Win32_PointingDevice — checks for VMware/VBox/Oracle), hard disk model strings (Win32_DiskDrive), motherboard manufacturer strings (Win32_BaseBoard), Sandboxie DLL (SbieDll.dll), VBox DLL (vboxmrxnp.dll), VMware DLLs (vmGuestLib.dll / vmbusres.dll), and a time zone check (DaylightName compared against Iran, Arab, Arabia, Middle East — covering UTC+2/+3/+3.5/+4 across 10 countries). A tenth check requires the user to click OK on a fake user32.dll error dialog, ensuring human interaction. Strings are obfuscated using a hyphen-delimited integer encoding (each value minus 1, converted to character). The GUID written to GDI.bin is used as the scheduled task name (replacing the hardcoded name in earlier variants), and the Trojan copies itself to %APPDATA%\Windows\WindowsImplantment.exe with hidden and system flags. C2 communication uses Internet Explorer application object HTTP requests; URL parameter strings are reversed from the previous variant (chk→khc, what→tahw, resp→pser, oops→spoo). A 2-second delay using cmd.exe choice is inserted post-dialog. Four commands are supported: run command (1), download file (2), read/upload file (3), and boom! (uninstall). C2 domain: windowspatch[.]com.

The OilRig group continued its espionage activities, primarily within the Middle East. Between May and June 2018, they orchestrated multiple attacks using compromised accounts from a Middle Eastern government agency, targeting a technology services provider and another government entity. The group leveraged a PowerShell backdoor called QUADAGENT and employed spear-phishing tactics, obfuscation using the Invoke-Obfuscation toolkit, and PE files to achieve their objectives. They also used stolen credentials and decoy dialog boxes to reduce suspicion and evade detection.

The OilRig group continued its espionage activities, primarily within the Middle East. Between May and June 2018, they orchestrated multiple attacks using compromised accounts from a Middle Eastern government agency, targeting a technology services provider and another government entity. The group leveraged a PowerShell backdoor called QUADAGENT and employed spear-phishing tactics, obfuscation using the Invoke-Obfuscation toolkit, and PE files to achieve their objectives. They also used stolen credentials and decoy dialog boxes to reduce suspicion and evade detection.

The OilRig threat group initiated an attack targeting organizations in the Middle East through spear-phishing emails with a malicious Microsoft Word document called ThreeDollars. The document contained a new payload, OopsIE Trojan, which was delivered either directly or through the document. OilRig implemented different delivery tactics due to prior encounters with their targeted organization. They also adopted password-protected documents as an evasion tactic. The OopsIE Trojan communicated with a C2 server and executed commands provided by it.

OilRig was identified by Unit 42 as deploying a secondary backdoor, RGDoor, via the TwoFace webshell to regain access to compromised webservers once TwoFace was detected and removed. Targeting eight Middle Eastern government organizations, a financial institution, and an educational institution, RGDoor allows OilRig to execute commands and upload and download files from the server. The backdoor was created using C++, resulting in a DLL that relies on HTTP POST requests to communicate with the backdoor.

Unit 42 monitored OilRig's testing of the TwoFace webshell, specifically its TwoFace++ variant, to evade detection by security tools. Analysis revealed that OilRig's developers systematically modified the webshell's loader script to reduce detection rates, ultimately achieving zero detection by altering code related to the embedded payload's update functionality. The testing involved decoding and encrypting webshell data and frequent code alterations to pinpoint and circumvent security measures. Additionally, another webshell, named DarkSeaGreenShell, was discovered during these tests.

The Iranian cyber espionage group APT34 exploited two vulnerabilities (CVE-2017-0199 and CVE-2017-11882) in Microsoft Office to deliver malicious payloads against Middle Eastern governmental organizations. The group utilized spear-phishing emails with malicious .rtf files attached, which upon opening, exploited the vulnerabilities and executed malicious scripts. The scripts, POWRUNER and BONDUPDATER, performed actions such as persistence and command-and-control (C2) communication, including use of a domain generation algorithm (DGA) to evade detection.

The OilRig threat group has been utilizing a refined version of the Clayslide delivery document for spear-phishing attacks since May 2016. Recently, they have developed a new custom Trojan named "ALMA Communicator", and incorporated the use of Mimikatz for credential harvesting in the delivery phase of the attack. The targets included an individual at a public utilities company in the Middle East. ALMA Communicator uses DNS tunneling for C2 communication and has some data transfer limitations, which may have prompted the early deployment of Mimikatz.