OilRig's Poison Frog: From PowerShell Backdoors to Cisco AnyConnect Disguises
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Backdoor,Malware,Spear Phishing
- Attack Complexity: Medium
- Threat Risk: High Impact/Low Probability
Threat Overview
Kaspersky's December 2019 report analyzes Poison Frog, a PowerShell-based backdoor used by OilRig (APT34) discovered after scanning archives with a custom YARA rule. The earliest samples date to July 2017, with the malware named after its C2 domain poison-frog[.]club. Each sample is a PE32 executable written in C# that drops an embedded PowerShell script containing two backdoor agents — an HTTP backdoor (59 lines) and a DNS backdoor (335 lines) — and deletes the dropper after execution. The HTTP agent generates a UID from the MAC address or whoami output, then beacons to the C2 to receive commands: execute a shell command and return output, check for and upload a file, or receive and save a file to disk. The DNS agent supports the same command execution and file transfer functions. Persistence is achieved via Windows Task Scheduler. To improve delivery odds, OilRig disguised the malware as a legitimate Cisco AnyConnect VPN application, though implementation errors were present — including a popup appearing on every click and a typo rendering one sample non-functional ("Poweeershell.exe"). Other sloppiness included PDB paths left in binaries and tampered compilation timestamps set to future dates. No specific targeted sectors or countries are named in this report.
Extracted IOCs
- poison-frog[.]club
- 4ea656d10be1d6eac05d69252d270592
- 87fb0c1e0de46177390de3ee18608b21
- c9f16f0be8c77f0170b9b6ce876ed7fb
Tip: 4 related IOCs (0 IP, 1 domain, 0 URL, 0 email, 3 file hash) to this threat have been found.
Overlaps
Source: Palo Alto Network - April 2019
Detection (one case): poison-frog[.]club
Source: Booz Allen - February 2018
Detection (four cases): 4ea656d10be1d6eac05d69252d270592, 87fb0c1e0de46177390de3ee18608b21, c9f16f0be8c77f0170b9b6ce876ed7fb, poison-frog[.]club
Source: Mandiant - December 2017
Detection (one case): c9f16f0be8c77f0170b9b6ce876ed7fb
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
Frequently Asked Questions About OilRig's Poison Frog Backdoor
Kaspersky researchers discovered Poison Frog, a PowerShell-based backdoor developed and deployed by OilRig (APT34), after running a YARA rule against their malware archive. The tool — named after its command-and-control domain, poison-frog[.]club — was found in samples dating back to July 2017, confirming it was an active part of OilRig's toolkit for at least two years. The backdoor was designed to give attackers persistent remote access to compromised Windows systems, with the ability to execute commands and transfer files.
Poison Frog is attributed to OilRig, an Iranian state-sponsored threat group also known as APT34 and Helix Kitten. The tool was previously referenced in the April 2019 Lab Dookhtegan leak of OilRig tools, and Kaspersky's analysis links the samples to the group through overlapping C2 infrastructure, code patterns, and operational history consistent with prior OilRig campaigns.
Poison Frog gave OilRig persistent remote access to compromised systems — the ability to execute arbitrary shell commands, check for and exfiltrate files, and receive and save new files or payloads from the C2 server. The dual-channel design (HTTP and DNS) ensured the backdoor could maintain connectivity even if one protocol was blocked at the network perimeter. This is consistent with OilRig's broader mission of sustained espionage and intelligence collection.
The Kaspersky report does not name specific targeted organizations or countries for this particular tooling. OilRig's broader campaign history shows consistent targeting of Middle Eastern governments, energy companies, financial institutions, and telecommunications providers. The malware was active from at least July 2017 through the time of publication in December 2019, suggesting it was used across multiple operations during that period.
OilRig focused on government entities, energy companies, financial institutions, and telecommunications providers across the Middle East — consistent with Iran's strategic intelligence priorities. The malware was designed to blend into normal network traffic using both HTTP and DNS, two protocols that are routinely allowed through corporate firewalls, making it well-suited for environments with strict egress filtering.
Poison Frog was delivered as a PE32 executable written in C# that disguised itself as the Cisco AnyConnect VPN application. When executed, it dropped two PowerShell scripts — an HTTP backdoor and a DNS backdoor — ran them, and deleted the original dropper to remove traces. The HTTP agent generated a unique ID from the victim's MAC address or username, then beaconed to the C2 server. The DNS agent used DNS queries for the same purpose. Both agents then waited for commands: execute a shell command, upload a file to the attacker, or receive and save a file from the attacker. Persistence was maintained through Windows scheduled tasks that re-executed the scripts regularly.
Despite being an established state-sponsored group, OilRig made several careless mistakes with Poison Frog. One sample contained a typo — "Poweeershell.exe" instead of "Powershell.exe" — that caused it to fail entirely. PDB debug paths were left inside binaries, exposing internal development details. Compilation timestamps on some samples were forged to future dates, but inconsistently — one sample was found in the wild a full year before its claimed compilation date. The Cisco AnyConnect disguise also had a visible flaw: an info popup appeared every time the fake application was clicked, which the real AnyConnect doesn't do.
Block DNS queries to poison-frog[.]club and monitor for encoded data in DNS responses, which is characteristic of Poison Frog's DNS C2 channel. Audit Windows Task Scheduler for unauthorized entries pointing to PowerShell scripts in user-writable directories. Verify Cisco AnyConnect installation integrity using official file hashes and signature checks — any AnyConnect-named binary outside its expected installation directory should be treated as suspicious. Deploy behavioral detections for C# dropper executables that write PowerShell scripts to disk and self-delete, and monitor PowerShell processes making outbound HTTP or DNS connections alongside local file operations.