Uncovering OilRig’s Malware Testing Ops for Targeted Attacks in the Middle East

Palo Alto Unit42 documented OilRig's pre-attack testing process before their August 2018 BONDUPDATER attack on a Middle Eastern government. By finding 11 test documents that OilRig submitted to public antivirus scanning services in the days before the actual attack, researchers were able to map the entire 6-day preparation period — watching the attacker methodically reduce AV detections from 22 to 7 through iterative macro changes before finally launching the spearphishing attack 20 minutes after creating the final document.

The testing and the subsequent attack are attributed to OilRig, also known as APT34 — an Iranian state-linked cyberespionage group. Unit42 links the test files to OilRig based on the C2 domain (withyourface[.]com) embedded in the test filenames, the identical BONDUPDATER payload found in cached data inside the first test file, and the same hex-char string obfuscation technique seen across test files and the weaponized delivery document.

The testing phase wasn't itself an attack — it was preparation for one. OilRig's goal was to develop a spearphishing document that would bypass antivirus detection, then use it to deploy the BONDUPDATER backdoor on a Middle Eastern government machine. BONDUPDATER gives operators persistent remote access for espionage: command execution, file collection, and data exfiltration over DNS. The testing phase was the quality assurance step that made the final attack more likely to succeed undetected.

The testing spanned 6 days across three waves: August 20, 21, and 26, 2018. The attacker created 11 test documents and submitted each to public AV scanning services with an average of just 33 seconds between saving a file and uploading it — a remarkably fast feedback loop suggesting an organized, operator-driven process rather than automated generation. The final attack followed within 8 hours of the last test completion and was delivered to the target within 20 minutes of the weaponized document being created.

The target was a Middle Eastern government organization — the same nation state targeted by OilRig's concurrent QUADAGENT campaign in July–August 2018, though a different agency. Unit42 does not name the specific country. The consistent government sector targeting across multiple simultaneous campaigns in the same country suggests OilRig was conducting broad, coordinated espionage operations against multiple ministries rather than focusing on a single target.

OilRig systematically isolated which parts of their VBA macro triggered antivirus detections by making one targeted change per iteration, resubmitting, and measuring the result. Key findings: including "powershell.exe" as a string triggered detections; running a VBScript via wscript from the macro triggered others; using the vbHide flag to hide the execution window added 8 extra detections compared to vbNormalFocus; and generic Shell function calls were detected regardless of the command. The solution that worked: replacing sensitive strings like "powershell", "cmd.exe", and "wscript" with character-by-character hex concatenation (Chr(CLng("&H70"))&...) — a technique that was then applied in the final weaponized Word document and the subsequent attack.

This report is unusual because it documents an attack before it happened from a defender's perspective — the test files were publicly visible on AV scanning services days before the actual spearphishing email was sent. This raises a practical defensive opportunity: organizations can monitor public AV scanning services for submissions of documents containing their own internal terminology, branding, or domain names. OilRig's practice of naming test files with the C2 domain (withyourface[.]com) made the link to the eventual attack obvious in retrospect. Tracking such submissions in near real time could theoretically provide advance warning of an impending targeted attack.