OilRig Group Unleashes Coordinated Cyber Campaigns on Saudi Arabian Industries

Palo Alto Unit42 documented a two-wave targeted attack campaign against Saudi Arabian organizations — naming both the threat group (OilRig) and the backdoor (Helminth) for the first time. The group ran an August 2015 wave using fake job offer lures and a May 2016 wave using a service-provider social engineering theme. Both waves delivered the Helminth backdoor, giving attackers persistent remote access to compromised Saudi financial, technology, defense, and telecommunications organizations.

The campaign is attributed to OilRig — a threat group Unit42 named in this report. The name "OilRig" comes from "Nafti" (نفتی), a Persian word meaning "oily," hardcoded into malware samples alongside philosopher names like Plato, Arasto (Persian for Aristotle), and ALAfghani (an Islamic philosopher). WHOIS registrant data for C2 domains included Iranian email addresses on the chmail.ir provider and Tehran as the geolocation — consistent with Iranian-based operators, though Unit42 acknowledges WHOIS data can be falsified. OilRig is now assessed to be an Iranian state-linked cyberespionage group, also known as APT34.

The goal was espionage. Helminth provides attackers with a fully functional remote shell — operators can run arbitrary commands, collect system information, upload and download files, and exfiltrate data over both HTTP and DNS channels. The executable variant adds keylogging and clipboard capture. The hardcoded Group and Name values per sample confirm the attackers researched their targets beforehand and tailored each deployment to a specific organization.

The campaign targeted Saudi Arabian organizations across financial institutions, technology companies, the defense industry, and telecommunications firms. The attack waves ran from at least August 2015 through May 2016. Group names hardcoded in the executable variant's beacons included confirmed Saudi defense and telecom organization names, verifying deliberate sector-specific targeting rather than opportunistic infection.

Confirmed targeted sectors were financial institutions, technology organizations, the defense industry, and telecommunications companies — all within Saudi Arabia. The two-year campaign focused exclusively on Saudi targets, consistent with Iranian state interest in monitoring and disrupting Saudi economic, military, and communications infrastructure.

The 2016 wave used Clayslide — a malicious Excel spreadsheet that displayed a fake "Incompatible" worksheet telling the user to enable macros. Once enabled, the macro hid that worksheet, displayed a legitimate-looking decoy (a table of internal IP addresses), and silently installed two scripts: update.vbs communicated with the C2 server over HTTP to download and run batch commands, while dns.ps1 used DNS queries to send data back — encoding command output in the subdomains of DNS queries. A scheduled task named "GoogleUpdateTaskMachineUI" ran update.vbs every three minutes for persistence. The 2015 wave used a job offer ZIP file with a dropper (HerHer Trojan) that installed the standalone Helminth executable plus a keylogger DLL, persisting via a startup folder shortcut.

Saudi Arabia's financial, defense, and telecommunications sectors represent high-value intelligence targets for Iranian state-aligned actors. Saudi Aramco and the broader Saudi energy and defense complex are strategic rivals to Iranian interests in the region. Access to Saudi defense networks in particular provides intelligence on military capabilities and procurement — exactly the kind of information that would be valuable to Iran's defense planning. The consistent, sustained targeting over years demonstrates a standing intelligence-collection mandate against these Saudi sectors.