OilRig: Cyber-Espionage Targeting Global Critical Sectors

OilRig, also known as APT34, is an Iranian state-sponsored threat group active since at least 2016. They run long-term cyber-espionage campaigns against government agencies, energy and oil companies, telecoms, financial institutions, and universities — primarily in the Middle East, with operations extending to Europe, North America, and Asia. Their methods range from spearphishing emails to custom malware and DNS tunneling for covert communications. In some cases they have also deployed destructive disk-wiping malware. SOCRadar published a comprehensive profile of the group in January 2025, summarizing their full decade of documented activity.

OilRig is widely attributed to Iranian state interests. The group's targeting — focused on Iran's regional rivals in the Middle East, organizations connected to energy and oil markets, and entities that could provide geopolitical intelligence — is consistent with Iranian government collection priorities. Multiple security vendors including Palo Alto, FireEye, and CrowdStrike have attributed the group to Iran. OilRig is also known by several aliases: APT34, Helix Kitten, and Earth Simnavaz.

OilRig's primary goal is espionage — collecting intelligence that serves Iranian state interests. This includes stealing government communications, energy sector data, financial intelligence, and information about military and defense programs. The group also collects credentials at scale, which they reuse to maintain persistent access and pivot through networks. In some operations, they have gone beyond espionage and deployed destructive malware (ZeroCleare) capable of wiping entire disk systems — showing they can shift from intelligence collection to sabotage when directed to do so.

OilRig operates at significant scale — active since 2016 across the Middle East, Europe, North America, and Asia. Confirmed targets include organizations in Saudi Arabia, the UAE, Qatar, Kuwait, Turkey, and beyond. Sectors affected include government, energy and oil and gas, telecommunications, finance, defense, universities, and research institutions. Their consistent activity over nearly a decade across multiple continents makes them one of the broadest-operating Iranian APT groups in terms of geographic and sectoral reach.

OilRig primarily targets government agencies, energy and oil and gas companies, telecommunications providers, financial institutions, defense organizations, universities, and research institutions. Their focus on energy and oil aligns with Iran's interest in monitoring global energy markets and gaining competitive intelligence. Government and defense targets yield strategic and political intelligence. Telecoms provide access to communications infrastructure and subscriber data. Universities and think tanks are targeted for research on technology, cybersecurity, and political topics relevant to Iran's interests.

OilRig follows a structured kill chain. They begin with spearphishing — sending targeted emails with malicious attachments or links, and in some cases reaching out via LinkedIn. Once a victim opens the malicious file or clicks the link, custom malware like Helminth or BondUpdater is installed, establishing a backdoor. The group then uses PowerShell, Windows Command Shell, and VBScript to execute commands, dumps credentials with Mimikatz and LaZagne, and moves laterally through the network using stolen credentials and tools like PAExec. For persistence, they deploy web shells on servers and abuse the Outlook Home Page feature (CVE-2017-11774). Command and control runs primarily over DNS tunneling, with HTTP fallback and Plink-based encrypted tunnels. Data is exfiltrated over FTP, separate from the C2 channel. In some operations, they have deployed ZeroCleare to wipe disk data on target systems.

OilRig's targets hold information that directly serves Iranian strategic interests. Middle Eastern governments hold intelligence about regional security, diplomatic negotiations, and military capabilities — all critical for Iran's foreign policy. Energy and oil companies provide competitive intelligence about global energy markets and pricing, which matters enormously to an economy built on oil exports. Telecoms give access to communications infrastructure that can be monitored or disrupted. Defense organizations hold data about weapons programs and military capabilities that Iran needs to assess threats and plan responses. Universities and think tanks produce research that shapes policy toward Iran. Together, these targets give OilRig a comprehensive intelligence picture spanning political, economic, and military domains.