Iranian Cyber Espionage Group OilRig's Secrets Unveiled
- Actor Motivations: Espionage
- Attack Vectors: Backdoor
- Attack Complexity: Medium
- Threat Risk: Unknown
Threat Overview
Hackers under the alias Lab Dookhtegan (لب دوختگان) leaked details about Iranian APT group OilRig (APT34), exposing tools, infrastructure, and victims. The dump, shared via Telegram, included the source code for tools like Poison Frog, DNSpionage (Webmask), and web shells (HyperShell, HighShell). Credentials, database dumps, and Mimikatz outputs from Middle Eastern government and corporate targets were revealed, including Dubai Media Inc, Etihad Airways, and Bahrain’s NSA. This disclosure highlights the targeting of government, aviation, energy, and media sectors, particularly in the UAE, Kuwait, Oman, and Bahrain.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Case | Amiri Diwan The Amiri Diwan of Kuwait serves as the royal court of the Emir of Kuwait. Amiri Diwan has been targeted by OilRig as the main target. | Medium |
| Case | Dubai Media Incorporation Reported compromised organizational victim; leaked credentials described by BleepingComputer, archive p. 4. No personal records inspected. Dubai Media Incorporated is the official media organization of the government of Dubai. It was established in 2003 as a state-owned company comprising a number of print, radio and TV channels under its umbrella, including: Dubai TV, Al Bayan, Dubai One, Dubai Sports, Emirates 24/7, Tawseel and Masar Printing Press. Dubai Media Incorporation has been targeted by OilRig as the main target. | Medium |
| Case | Emirates National Oil Company (ENOC) ENOC is a global diversified state-owned energy group that operates in the oil, gas, and coal industry. Emirates National Oil Company (ENOC) has been targeted by OilRig as the main target. | Medium |
| Case | Etihad Airways Etihad Airways is one of two flag carriers of the United Arab Emirates, alongside Emirates. Etihad Airways has been targeted by OilRig as the main target. | Medium |
| Case | Lamprell Lamprell plc, based in the United Arab Emirates, specialises in construction and fabrication, servicing both the Renewables and Oil & Gas industries. It builds wind turbine foundations as well as shallow-water drilling jackup rigs, liftboats and land rigs, and it also carries out rig refurbishment. Lamprell has been targeted by OilRig as the main target. | Medium |
| Case | National Security Agency The NSA was formed after King Hamad issued Decree No. 14 of 2002 declaring it as the replacement of the General Directorate for State Security Investigations. National Security Agency has been targeted by OilRig as the main target. | Medium |
| Case | Presidential Court (Ministry of Presidential Affairs) Presidential Court (Ministry of Presidential Affairs) has been targeted by OilRig as the main target. | Medium |
| Case | Prime Minister's Office Prime Minister's Office has been targeted by OilRig as the main target. | Medium |
| Case | Supreme Judicial Council (Administrative Court) Supreme Judicial Council (Administrative Court) has been targeted by OilRig as the main target. | Medium |
| Sector | Government Agencies and Services | Medium |
| Sector | Energy | Medium |
| Sector | Media | Medium |
| Sector | Transportation | Medium |
| Region | Bahrain | Medium |
| Region | Kuwait | Medium |
| Region | Oman | Medium |
| Region | United Arab Emirates | Medium |
Extracted IOCs
- 103[.]102.44.181
- 103[.]102.45.14
- 109[.]236.85.129
- 142[.]234.200.99
- 146[.]112.61.108
- 158[.]69.57.62
- 168[.]187.92.92
- 172[.]241.140.238
- 172[.]81.134.226
- 173[.]234.153.194
- 173[.]234.153.201
- 176[.]9.164.215
- 178[.]32.127.230
- 185[.]140.249.157
- 185[.]140.249.63
- 185[.]15.247.140
- 185[.]161.209.157
- 185[.]161.211.86
- 185[.]174.100.56
- 185[.]174.102.14
- 185[.]181.8.158
- 185[.]181.8.252
- 185[.]191.228.103
- 185[.]20.187.8
- 185[.]227.108.35
- 185[.]236.76.35
- 185[.]236.76.59
- 185[.]236.76.80
- 185[.]236.77.17
- 185[.]236.77.75
- 185[.]236.78.217
- 185[.]236.78.63
- 185[.]56.91.61
- 190[.]2.142.59
- 194[.]9.177.15
- 194[.]9.178.10
- 194[.]9.179.23
- 198[.]143.182.22
- 213[.]202.217.9
- 213[.]227.140.32
- 217[.]182.217.122
- 23[.]106.215.76
- 23[.]19.226.69
- 23[.]227.201.6
- 38[.]132.124.153
- 46[.]105.251.42
- 46[.]165.246.196
- 46[.]4.69.52
- 70[.]36.107.34
- 81[.]17.56.249
- 88[.]99.246.174
- 95[.]168.176.172
- 95[.]168.176.173
Tip: 53 related IOCs (53 IP, 0 domain, 0 URL, 0 email, 0 file hash) to this threat have been found.
Overlaps
Source: Palo Alto Networks - January 2020
Detection (three cases): 185[.]15.247.140, 185[.]161.211.86, 213[.]202.217.9
Source: Palo Alto Network - September 2019
Detection (two cases): 185[.]15.247.140, 213[.]202.217.9
Source: Cyware - August 2019
Detection (53 cases): 103[.]102.44.181, 103[.]102.45.14, 109[.]236.85.129, 142[.]234.200.99, 146[.]112.61.108, 158[.]69.57.62, 168[.]187.92.92, 172[.]241.140.238, 172[.]81.134.226, 173[.]234.153.194, 173[.]234.153.201, 176[.]9.164.215, 178[.]32.127.230, 185[.]140.249.157, 185[.]140.249.63, 185[.]15.247.140, 185[.]161.209.157, 185[.]161.211.86, 185[.]174.100.56, 185[.]174.102.14, 185[.]181.8.158, 185[.]181.8.252, 185[.]191.228.103, 185[.]20.187.8, 185[.]227.108.35, 185[.]236.76.35, 185[.]236.76.59, 185[.]236.76.80, 185[.]236.77.17, 185[.]236.77.75, 185[.]236.78.217, 185[.]236.78.63, 185[.]56.91.61, 190[.]2.142.59, 194[.]9.177.15, 194[.]9.178.10, 194[.]9.179.23, 198[.]143.182.22, 213[.]202.217.9, 213[.]227.140.32, 217[.]182.217.122, 23[.]106.215.76, 23[.]19.226.69, 23[.]227.201.6, 38[.]132.124.153, 46[.]105.251.42, 46[.]165.246.196, 46[.]4.69.52, 70[.]36.107.34, 81[.]17.56.249, 88[.]99.246.174, 95[.]168.176.172, 95[.]168.176.173
Source: CrowdStrike - January 2019
Detection (two cases): 185[.]15.247.140, 185[.]20.187.8
Source: Openminded - January 2019
Detection (one case): 185[.]236.78.63
Source: Cisco Talos - November 2018
Detection (one case): 185[.]20.187.8
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
OilRig leak: what the report establishes
People using the name Lab Dookhtegan released tools and victim information associated with OilRig through Telegram. BleepingComputer reported on the disclosures in April 2019, including leaked credentials and organizational records.
The article identifies OilRig, also known as APT34, as a cyber-espionage group linked to the Iranian government. BleepingComputer says Chronicle confirmed that the leaked information was associated with this group. The identity of the leakers is not established.
The named victims were mainly government agencies and companies in the Middle East, including organizations in the UAE, Kuwait, Oman and Bahrain. Aviation, energy and media organizations were among them. The article also describes web shells on servers worldwide, but does not establish a complete victim count or the dates of each intrusion.
The disclosures included backdoors, web shells, credentials and database material. Some passwords were apparently cracked with a password-recovery tool, and other files contained output from a credential-related security tool. The article does not explain how the attackers first entered each victim network.
BleepingComputer describes OilRig as a cyber-espionage group. The leaked victim information illustrates access to government and corporate resources, but the article does not establish the objective of every individual intrusion.
The article does not give specific defensive recommendations. A Chronicle researcher assessed that the leak might force OilRig to change its tools and that some copycat use was possible, while widespread reuse was considered unlikely. These were assessments at the time, not confirmed later outcomes.