OilRig's Use of BONDUPDATER: A Stealthy Cyber Espionage Campaign on Bahrain
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Backdoor,Spear Phishing
- Attack Complexity: High
- Threat Risk: High Impact/Low Probability
Threat Overview
NETSCOUT ASERT captured live command and control traffic from an updated BONDUPDATER variant targeting the Office of the First Deputy Prime Minister of Bahrain via spearphishing emails — activity the team attributes to OilRig (APT34). ASERT reverse-engineered the malware's C2 protocol in real time, documenting two key mechanisms. Command delivery uses DNS TXT records: the attacker's nameserver returns base64-encoded commands (with modified padding characters) in a structured format prefixed by a 5-character identifier and delimited by a ">" character, allowing multi-part commands to be reassembled on the victim machine. Data exfiltration uses DNS A record queries, with output stuffed into custom subdomains using a distinctive nibble-splitting obfuscation technique: each byte of data is split into its two 4-bit nibbles, with first nibbles placed in one list and second nibbles in another, joined end-to-end to form subdomain strings. Exfiltration sessions are bracketed by "COCTab" (start) and "COCTabCOCT" (end) markers in the subdomain, alongside a command identification value allowing the attacker to map responses to issued commands. ASERT observed the attacker running whoami and ipconfig /all as initial reconnaissance commands. The C2 domain used was withyourface[.]com. NETSCOUT notes that BONDUPDATER's continuous development — including this new obfuscation layer — indicates OilRig's ongoing investment in evading detection, and recommends monitoring DNS traffic for abnormally long domain names and scanning DNS A record subdomains for the "COCTab" string as a specific detection indicator.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Government Agencies and Services | Verified |
| Region | Bahrain | Verified |
Extracted IOCs
- withyourface[.]com
- 52b6e1ef0d079f4c2572705156365c06
- 8c4fa86dcc2fd00933b70cbf239f0636
Tip: 3 related IOCs (0 IP, 1 domain, 0 URL, 0 email, 2 file hash) to this threat have been found.
Overlaps
Source: Palo Alto Network - April 2019
Detection (one case): withyourface[.]com
Source: Palo Alto Networks - November 2018
Detection (one case): withyourface[.]com
Source: Palo Alto Network - September 2018
Detection (one case): withyourface[.]com
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
Frequently Asked Questions: OilRig's BONDUPDATER Targeting Bahrain's Government
OilRig (APT34), an Iranian state-aligned threat group, sent targeted spearphishing emails to the Office of the First Deputy Prime Minister of Bahrain, delivering an updated version of their BONDUPDATER malware. NETSCOUT ASERT captured live communications between the malware and the attacker's server, uncovering a new obfuscation technique for hiding stolen data inside DNS queries. The campaign was discovered and reported jointly with Palo Alto Unit42 in September 2018.
The attack is attributed to OilRig, also known as APT34, an Iranian state-linked cyberespionage group with a long history of targeting government and critical sector organizations across the Middle East. BONDUPDATER is one of OilRig's signature tools, first documented by FireEye in November 2017. The C2 domain (withyourface[.]com) used in this campaign overlaps with OilRig infrastructure documented in multiple prior reports, confirming attribution.
The goal was espionage. BONDUPDATER gives the attacker persistent remote access to compromised systems, allowing them to run commands, collect system information, and exfiltrate data covertly over DNS. Targeting the office of a senior Bahraini government official suggests the operation was focused on gathering political or diplomatic intelligence of interest to the Iranian state.
The campaign was narrowly targeted at the Office of the First Deputy Prime Minister of Bahrain. This is a single high-value government target, consistent with OilRig's pattern of precision spearphishing against specific government officials and institutions in the Gulf region. The Palo Alto Unit42 report published at the same time identified similar activity targeting a Middle Eastern government, suggesting a coordinated or parallel campaign.
The confirmed target was Bahrain's government sector — specifically the office of a senior official in the executive branch. This is consistent with OilRig's established targeting profile, which focuses on government, financial, energy, and critical infrastructure organizations across the Middle East, with particular interest in Gulf Cooperation Council states that Iran views as strategically significant.
The attack began with a spearphishing email carrying a malicious Word document. Once opened, BONDUPDATER — a PowerShell backdoor — was installed and began communicating with the attacker's server entirely through DNS. Commands were delivered via DNS TXT records as encoded instructions. Stolen data was exfiltrated via DNS A record queries, with output embedded in subdomains using a custom technique that splits each byte into two halves and reassembles them in a specific order to obscure the content. NETSCOUT captured live sessions showing the attacker running whoami and ipconfig /all as initial reconnaissance steps.
Senior government offices in Bahrain and other Gulf states are high-value intelligence targets for Iran. Bahrain hosts the US Navy's Fifth Fleet and has close security ties with Saudi Arabia — making its government communications particularly valuable to Iranian intelligence services. OilRig's consistent targeting of Gulf government institutions reflects Iran's broader strategic interest in monitoring and influencing regional political dynamics.
Monitor DNS traffic for abnormally long subdomain strings — BONDUPDATER's nibble-split exfiltration produces unusually long domain names that stand out in DNS logs. Look specifically for the string "COCTab" in DNS A record subdomains, which NETSCOUT identifies as a direct behavioral indicator of this variant. Enable PowerShell script block logging and alert on PowerShell spawned from Office application processes. Block the known C2 domain withyourface[.]com. Practice strict email hygiene and disable macros and remote template fetching in Microsoft Office environments to reduce the initial access risk from spearphishing documents.