OilRigMalware
Last reported 3 months ago, by Group-IB6 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1110.003Password Spraying
“…y la NSA publicada en octubre de 2024 documentó una campaña de un año en la que actores iraníes usaron password spraying y MFA push‑bombing (inundar a los usuarios con solicitudes de inicio de sesión hasta que alguien apruebe una por error) para…”
- T1195Supply Chain Compromise
“When it comes to attacks that give bad actors a lot of bang for their buck, supply chain compromise typically reigns supreme.”
- T1219Remote Access Tools
“If you rely on MSPs, inquire about how they secure their remote access tools and whether they've reviewed their own exposure in light of the conflict.”
- T1534Internal Spearphishing
“The group is also known to favor internal spearphishing from already-compromised inboxes – emails from a colleague's account rather than an external sender – with a high success rate, for obvious reasons.”
- T1556.009Conditional Access Policies
“Enforce Conditional Access policies, credential rotation, and anomalous-token detection are applied to Microsoft 365 and Entra ID environments.”
- T1566.001Spearphishing Attachment
“Spearphishing attachments and links have long been the most popular initial access techniques among most Iran-aligned APT groups, including OilRig and APT33.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels“Lyceum (sub-group of OilRig)”
-
El impacto en la ciberseguridad de la guerra en Irán: riesgos clave que debe monitorear“En particular, MuddyWater ha colaborado de cerca con Lyceum, un subgrupo de OilRig, y probablemente también ha actuado como initial access broker (IAB) para otros grupos iraníes.”
-
Cyber fallout from the Iran war: What to have on your radar“Notably, MuddyWater has worked closely with Lyceum, a subgroup of OilRig, as well as probably acted as an initial access broker (IAB) for other Iran-aligned groups.”
-
Hunting For In-Memory .NET Attacks“More recently, the OilRig APT Group used a packed .NET malware sample known as ISMInjector to evade signature based detection.”
-
“We find many things that others do not even see”“…t as unidentified individuals published classified information on Telegram, sharing facts about the Iranian government-linked APT groups OilRig and MuddyWater, including their tools, victims, and connections.”
-
Catching fish in muddy waters“They disclosed information about APT groups affiliated with the Iranian government (OilRig and MuddyWater), including their tools, victims, and links.”
Indicators in its reports
named in the reports above- cloudlanecdn[.]comin 1 report
- p.cloudlanecdn[.]comin 1 report
- q.cloudlanecdn[.]comin 1 report
- co[.]ilin 1 report
- 315bdba98c6fe863…88cae56d61c1in 1 report
- 1573e125197ec77d…26b46c53bd25in 1 report
- 75e51774b8f79e5f…980255621509in 1 report
- f3f3006f83047882…101bcc851da3in 1 report
- b3d0f6e4e3be395f…bc3564485effin 1 report
- 87e4f863efc6d41f…62b18dc08e99in 1 report
- 5fdd710e8f514a30…36caa0e0b591in 1 report
- gladiyator[.]tkin 1 report
- 94.23.148[.]194in 1 report
- 192.95.21[.]28in 1 report
- 46.105.84[.]146in 1 report
- 185.162.235[.]182in 1 report
- 09aabd2613d339d90ddbd4b7c09195a9in 1 report
- cfa845995b851aacdf40b8e6a5b87ba7in 1 report
- a61b268e9bc9b7e6c9125cdbfb1c422ain 1 report
- f12bab5541a7d8ef4bbca81f6fc835a3in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.