OilRig's Developmental Tactics: Evading Antivirus Through Rigorous Testing

Palo Alto Unit42 caught OilRig testing their ClaySlide delivery documents against public antivirus scanners in two sessions — June and November 2016. By finding these test files on public scanning services, researchers could reconstruct the attacker's entire development process iteration by iteration. The report established that OilRig follows an organized, professional testing workflow before using their malware in real attacks, and that this practice was already in place at least two years before the 2018 BONDUPDATER testing campaign Unit42 documented later.

The testing activities are attributed to OilRig, also known as APT34 — an Iranian state-linked cyberespionage group. Unit42 links the test files to OilRig based on the C2 domains embedded in the payloads (update-kernal[.]net, updateorg[.]com), the Helminth backdoor used across all November test samples, and the consistent ClaySlide delivery document format documented in prior OilRig reporting.

The testing was preparation for espionage operations. ClaySlide delivers the Helminth backdoor — a remote access trojan that gives OilRig persistent covert access to compromised machines. By refining their delivery documents to evade AV detection, OilRig aimed to extend the useful life of their toolset and increase the probability of successful initial access when they eventually deployed the documents against real targets.

The June 2016 session ran 18 iterations over about 2.25 hours on June 15, with a base file created two days earlier. The November 2016 session was tighter — 7 iterations in approximately 30 minutes on November 15, with a base created the previous day. Both sessions show a high-pace workflow: OilRig was making changes and resubmitting to AV scanners within minutes of each other, with the goal of pushing detections as low as possible before moving on.

OilRig used a disciplined isolation method. In June, they first stripped the Helminth payload entirely to focus on the macro — then systematically removed, added back, encoded, and misspelled individual code blocks to identify which specific lines triggered AV detections. Techniques included base64 and hex encoding of commands, intentional typos ("poawearshell", "scshtassks"), using a FireEye blog URL as a filler base64 string, and keyboard mashing. When testing reached a dead end, they reverted to the base document and restarted. In November, the focus shifted to document-level factors: worksheet names, cell content hashes, decoy themes, function names, and macro variable names — testing whether signature-based detections were keying on document metadata rather than code.

ClaySlide is an Excel spearphishing document that opens with a fake "Incompatible" worksheet instructing the user to "Enable Content." When macros are enabled, the document hides that worksheet, shows a legitimate-looking decoy (e.g., Cisco router config settings or a weak password list), and simultaneously installs the Helminth backdoor in the background. The decoy is carefully crafted to relate to the target's work — Unit42 noted that November 2016's decoy changed from a Cisco configuration to a list of weak passwords, suggesting OilRig was preparing a lure tailored to a specific upcoming target.

This report established that OilRig's AV testing practice was not new in 2018 — it had been running since at least mid-2016. Unit42 drew a direct line from this report to their 2018 BONDUPDATER testing analysis, confirming a multi-year institutional practice of iterative evasion refinement. It also showed OilRig's willingness to make test files non-functional during the process — they don't validate that malware works while testing evasion; they do both separately. This professionalism distinguishes OilRig from less organized threat actors who simply reuse the same tooling until it gets blocked.