Unraveling OilRig's Cyber Operations: Israel and Middle East in the Crosshairs

OilRig, an Iranian state-sponsored threat group, built a targeted attack infrastructure aimed at stealing credentials from specific Israeli organizations and maintaining persistent access to compromised web servers across the Middle East. The group deployed credential-harvesting websites that were exact copies of target login portals, alongside multiple web shells and post-exploitation tools on servers they had compromised. Palo Alto Networks Unit 42 uncovered the operation in September 2017 while investigating the TwoFace web shell they had previously documented.

The campaign is attributed to OilRig, an Iranian state-sponsored cyber-espionage group also linked to APT34 and Helix Kitten. Unit 42 established the connection through a shared Mimikatz sample found on both TwoFace-infected infrastructure and OilRig tooling, as well as significant targeting overlap between the two campaigns in the Middle East. OilRig is assessed to operate in support of Iranian government interests.

The primary objectives were credential theft and persistent network access. The credential harvesters were designed to collect login credentials from employees at specific Israeli institutions. Once access was gained via stolen credentials or web shell deployment, OilRig established multiple redundant backdoors for long-term presence, then used post-exploitation tools to move laterally and dump additional credentials — consistent with a strategic intelligence collection mission focused on Israel and the broader Middle East region.

The campaign targeted specific organizations in Israel and the broader Middle East. The credential harvesters directly named six Israeli targets: Tel Aviv University, Hebrew University of Jerusalem, Bezeq International (telecom), Macro Advisory Partners (strategic consulting), Tidhar Group (real estate), and the Institute for National Security Studies (think tank). Additional compromised web servers were located at educational and government institutions across Saudi Arabia and other Middle Eastern countries, which were used as infrastructure hop points.

The campaign focused on think tanks, academic institutions, strategic consulting firms, telecommunications providers, real estate companies, and the oil and gas sector — all organizations with strong connections to Israeli national security, regional economic intelligence, or Iran's geopolitical interests. The specificity of the credential harvesters (each one tailored to a named organization) confirms this was a deliberate, targeted operation rather than opportunistic credential theft.

The attack unfolded in two parallel tracks. In the first, OilRig registered .ml domains that mimicked the webmail portals of target organizations and stood up pixel-perfect replicas of their login pages — likely sending phishing emails to direct victims to these fake portals and capture their credentials. In the second track, OilRig deployed TwoFace, RunningBee, and LittleFace web shells on compromised web servers across the Middle East, using those servers as both C2 hop points and staging platforms. Post-exploitation tools including Mimikatz (credential dumping), PsExec (remote execution), Plink (SSH tunneling), and RGDoor (IIS backdoor) were then uploaded to maintain deep access and move laterally within victim networks.

Israel is a primary geopolitical rival of Iran, and Israeli universities, think tanks, and national security institutions produce and hold sensitive strategic intelligence. The Institute for National Security Studies directly informs Israeli defense policy. Macro Advisory Partners advises on Israel-region geopolitics. Bezeq International's telecom infrastructure provides potential access to communications data. OilRig's Middle Eastern focus also reflects Iran's broader interest in monitoring regional governments, oil sector activity, and organizations with connections to Iran's adversaries.