OilRig

OriginIrã

Techniques (MITRE ATT&CK)76

SourceMITRE ATT&CK

Also known as:COBALT GYPSYIRN2APT34Helix KittenEvasive SerpensHazel SandstormEUROPIUMITG13Earth SimnavazCrambusTA452

Vexday analysis

OilRig (também referenciado como APT34, COBALT GYPSY, Helix Kitten, Evasive Serpens e Hazel Sandstorm) é um grupo de ameaça persistente avançada de origem iraniana, ativo pelo menos desde 2014, que tem como alvos vítimas no Oriente Médio e em outros países. O grupo atua contra setores variados, incluindo financeiro, governamental, energético, químico e de telecomunicações, e conduz ataques à cadeia de suprimentos para atingir seus alvos primários por meio de relações de confiança entre organizações. Acredita-se que opere em nome do governo iraniano, conclusão baseada em detalhes de infraestrutura com referências ao Irã e em padrões de alvejamento alinhados a interesses de Estado. O MITRE ATT&CK (G0049) documenta 76 técnicas associadas ao grupo, que tem ainda 3 CVEs atribuídas como exploradas em suas operações.

Techniques (MITRE ATT&CK) 76

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Email Accounts Malware Tool Code Signing Certificates Upload Malware

Initial access

Supply Chain Compromise Spearphishing Attachment Spearphishing Link Spearphishing via Service

Execution

Windows Management Instrumentation Scheduled Task Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Exploitation for Client Execution Malicious Link Malicious File

Persistence

External Remote Services Outlook Home Page Web Shell Windows Service

Privilege escalation

Exploitation for Privilege Escalation

Credential access

LSASS Memory LSA Secrets Cached Domain Credentials Brute Force Credentials In Files Credentials from Password Stores Credentials from Web Browsers Windows Credential Manager

Discovery

System Service Discovery Query Registry System Network Configuration Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Process Discovery Local Groups Domain Groups System Information Discovery Local Account Domain Account Peripheral Device Discovery Password Policy Discovery

Lateral movement

Remote Desktop Protocol SSH

Collection

Data from Local System Data from Removable Media Keylogging Screen Capture Clipboard Data Automated Collection

Command and control

Fallback Channels Web Protocols DNS Ingress Tool Transfer Remote Access Tools Protocol Tunneling Asymmetric Cryptography

Exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

defense-impairment

Modify Registry Code Signing Password Filter DLL Windows Host Firewall

stealth

Indicator Removal from Tools Encrypted/Encoded File Masquerading Match Legitimate Resource Name or Location File Deletion Valid Accounts Domain Accounts Deobfuscate/Decode Files or Information Compiled HTML File System Checks

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2024-30088HIGHEPSS 68%KEV CVE-2017-11774HIGHEPSS 60%KEV CVE-2017-8625EPSS 15%

OilRig uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →