OilRig's Dual Campaigns Against Israeli Organizations: A Deep Dive

OilRig (APT34/Lyceum), an Iranian state-sponsored espionage group, conducted two successive campaigns exclusively targeting Israeli organizations: Outer Space in 2021 and Juicy Mix in 2022. In both campaigns, OilRig compromised legitimate Israeli websites to use as command-and-control servers, then deployed custom .NET backdoors via spearphishing emails. The group also stole browser credentials, cookies, and Windows Credential Manager data from compromised systems. ESET researchers uncovered and documented both campaigns in September 2023 and notified the Israeli CERT about the compromised websites.

The campaigns are attributed to OilRig, an Iranian state-sponsored threat group also tracked as APT34, Lyceum, and Siamesekitten. ESET connected Outer Space to OilRig through shared tooling — specifically the MKG Chrome data dumper — with earlier OilRig campaigns, as well as structural similarities between the Solar backdoor and other confirmed OilRig backdoors (Shark, DanBot, Milan). Juicy Mix was linked through code similarities between Mango and Solar, shared VBS dropper obfuscation techniques, and consistent Israeli targeting patterns.

The primary goal was intelligence collection. OilRig focused on stealing browser credentials, cookies, browsing history, and Windows-stored passwords from compromised systems — data that could provide access to additional accounts and services. The use of compromised legitimate Israeli websites as C2 servers, and Exchange Web Services draft emails for covert communication, reflects a focus on avoiding detection while maintaining long-term access to target networks.

Both campaigns exclusively targeted Israeli organizations. In Outer Space, OilRig compromised an Israeli human resources company's web server for C2 and used it to target victims in the same sector. In Juicy Mix, a legitimate Israeli job portal was compromised for C2, and the campaign's malicious tools were deployed against a healthcare organization in Israel. A third-party Seychelles Licensing Authority website was also observed in the IOC set. OilRig's consistent focus on Israel aligns with Iran's geopolitical objectives.

Human resources and healthcare organizations in Israel hold personal and professional data of intelligence value — employment records, medical histories, and contact networks linked to individuals of interest to Iran. OilRig has consistently targeted Israeli organizations since at least 2021, and these campaigns fit the group's documented pattern of sustained espionage against Iran's primary regional rival. The use of Israeli websites as C2 servers also helps OilRig blend attack traffic into expected communications with local organizations.

In both campaigns, VBS droppers — likely delivered as spearphishing email attachments — decoded and installed the backdoor, created a scheduled task for persistence, and registered the infection with the C2 server. In Outer Space, the Solar backdoor used XOR encryption and beaconed to a compromised Israeli HR website for commands. In Juicy Mix, the upgraded Mango backdoor used TLS encryption and native Windows APIs, communicating with a compromised job portal. Post-compromise, OilRig deployed a suite of credential theft tools: CDumper and EDumper for browser data (Chrome and Edge), IDumper for Windows Credential Manager, and MKG for Chrome cookies and history. The SC5k downloader fetched additional tools by reading commands hidden in Microsoft Exchange draft email messages — a covert channel that blends with normal email traffic.

Solar is the simpler first-stage backdoor used in Outer Space, written in C#/.NET with basic XOR encryption and two scheduled tasks — one for C2 communication (Earth) and one for automated file staging and upload (Venus). Mango is its successor, used in Juicy Mix, with notable upgrades: TLS encryption for C2 traffic, symbol name obfuscation and string stacking to resist static analysis, native API usage for command execution, and a backdoor command for on-demand file exfiltration replacing Solar's automated Venus task. Mango also contains unused code to block non-Microsoft DLLs from loading in child processes — a technique that could be activated in future versions to hinder EDR solutions.