Threat Actor 🇮🇷 Iran

OilRig

Also known as: Twisted Kitten · Cobalt Gypsy · Crambus · Helix Kitten · APT 34 · APT34 · IRN2 · ATK40 · G0049 · Evasive Serpens · Hazel Sandstorm · EUROPIUM · TA452 · Earth Simnavaz

OilRig is an Iranian threat group operating primarily in the Middle East by targeting organizations in this region that are in a variety of different industries; however, this group has occasionally targeted organizations outside of the Middle East as well. It also appears OilRig carries out supply chain attacks, where the threat group leverages the trust relationship between organizations to attack their primary targets. OilRig is an active and organized threat group, which is evident based on their systematic targeting of specific organizations that appear to be carefully chosen for strategic purposes. Attacks attributed to this group primarily rely on social engineering to exploit the human rather than software vulnerabilities; however, on occasion this group has used recently patched vulnerabilities in the delivery phase of their attacks. The lack of software vulnerability exploitation does not necessarily suggest a lack of sophistication, as OilRig has shown maturity in other aspects of their operations. Such maturities involve: -Organized evasion testing used the during development of their tools. -Use of custom DNS Tunneling protocols for command and control (C2) and data exfiltration. -Custom web-shells and backdoors used to persistently access servers. OilRig relies on stolen account credentials for lateral movement. After OilRig gains access to a system, they use credential dumping tools, such as Mimikatz, to steal credentials to accounts logged into the compromised system. The group uses these credentials to access and to move laterally to other systems on the network. After obtaining credentials from a system, operators in this group prefer to use tools other than their backdoors to access the compromised systems, such as remote desktop and putty. OilRig also uses phishing sites to harvest credentials to individuals at targeted organizations to gain access to internet accessible resources, such as Outlook Web Access. Since at least 2014, an Iranian threat group tracked by FireEye as APT34 has conducted reconnaissance aligned with the strategic interests of Iran. The group conducts operations primarily in the Middle East, targeting financial, government, energy, chemical, telecommunications and other industries. Repeated targeting of Middle Eastern financial, energy and government organizations leads FireEye to assess that those sectors are a primary concern of APT34. The use of infrastructure tied to Iranian operations, timing and alignment with the national interests of Iran also lead FireEye to assess that APT34 acts on behalf of the Iranian government.

Indicators of Compromise 38

Domain accesslinkssl[.]com Domain clipeditskill[.]com Domain cloudlanecdn[.]com Domain decoraat[.]net Domain google[.]com[.]ayalon-print[.]co[.]il Domain hospitalinstallation[[.]]com Domain ns1[.]cloudlanecdn[.]com Domain ns2[.]cloudlanecdn[.]com Domain ns3[.]cloudlanecdn[.]com Domain ns4[.]cloudlanecdn[.]com Domain onedown[.]gesecole[.]net Domain studiotikva[.]com Filename AVK.exe Filename AVKTray.dat Filename Avk.dll Filename Invitation_Letter_No.02_2026.csproj Filename Invitation_Letter_No.02_2026.exe Filename db.dll Filename logAzure.txt Filename mhm.dll Filename n-HTCommp.dll Filename n-sws.dll Filename n-ten.dll Filename ode.dll Filename uxtheme.dll MD5 29b2b8c5d99f05bfcdd0d8d976eb5678 MD5 c092b02fbc0fdf7ee9608dd016673806 MD5 caf021dda726b8ba049c2aa395e505a1 SHA-256 29cd44aa2a51a200d82cca578d97dc13241bc906ea6a33b132c6ca567dc8f3ad SHA-256 46314092c8d00ab93cbbdc824b9fc39dec9303169163b9625bae3b1717d70ebc SHA-256 5f9af68db10b029453264cfc9b8eee4265549a2855bb79668ccfc571fb11f5fc SHA-256 6df8649bf4e233ee86a896ee8e5a3b3179c168ef927ac9283b945186f8629ee7 SHA-256 7ed0cd4115f3ff35c38d36cc50c6a13eba2d845554439a36108789cd1e05b176 SHA-256 8421e7995778faf1f2a902fb2c51d85ae39481f443b7b3186068d5c33c472d99 SHA-256 d293ded5a63679b81556d2c622c78be6253f500b6751d4eeb271e6500a23b21e SHA-256 de8ddc2451fb1305d76ab20661725d11c77625aeeaa1447faf3fbf56706c87f1 IP 144[.]172[.]108[.]205 IP 216[.]126[.]237[.]197

MITRE ATT&CK TTPs 29

T1001.002
Steganography
Command And Control
 T1003
OS Credential Dumping
Credential Access
 T1021.001
Remote Desktop Protocol
Lateral Movement
 T1027
Obfuscated Files or Information
Defense Evasion
 T1036
Masquerading
Defense Evasion
 T1036.005
Match Legitimate Name or Location
Defense Evasion
 T1055
Process Injection
Defense Evasion
 T1055.001
Dynamic-link Library Injection
Defense Evasion
 T1059
Command and Scripting Interpreter
Execution
 T1059.001
PowerShell
Execution
 T1059.003
Windows Command Shell
Execution
 T1071.001
Web Protocols
Command And Control
 T1071.004
DNS
Command And Control
 T1074
Data Staged
Collection
 T1074.001
Local Data Staging
Collection
 T1082
System Information Discovery
Discovery
 T1090
Proxy
Command And Control
 T1090.003
Multi-hop Proxy
Command And Control
 T1102
Web Service
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1114
Email Collection
Collection
 T1132.001
Standard Encoding
Command And Control
 T1204.002
Malicious File
Execution
 T1558
Steal or Forge Kerberos Tickets
Credential Access
 T1558.003
Kerberoasting
Credential Access
 T1566
Phishing
Initial Access
 T1566.001
Spearphishing Attachment
Initial Access
 T1583
Acquire Infrastructure
Resource Development
 T1588
Obtain Capabilities
Resource Development

Source Articles

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Iranian nation-state actors linked to Cavern (aka Cav3rn) C2 framework have evolved their infrastructure to blend malicious traffic with legitimate services, using DNS A-record queries to dynamically switch between direct HTTPS and Google Apps Script relays for command-and-control. A new module, HOLLOWGRAPH, abuses Microsoft 365 calendars via the Graph API to exfiltrate data and receive commands, with events scheduled far into the future to avoid detection. The framework uses a modular architecture with components like GoogleService.dll and rnp.dll, leveraging legitimate cloud services to evade perimeter defenses and maintain persistence.
hacker-news ·2w ago
PlugX Meeting Invitation via MSBuild and GDATA
A recent PlugX RAT campaign leverages a spear-phishing email with the subject 'Meeting Invitation' to deliver malicious payloads via DLL side-loading. The infection chain uses a legitimate G DATA antivirus executable (Avk.exe) to load a malicious DLL (Avk.dll), which decrypts and executes the payload from AVKTray.dat. The malware establishes persistence through a registry Run key and communicates with the C2 server at decoorat[.]net over HTTPS on port 443. The campaign demonstrates continued use of trusted binaries, XOR-based obfuscation, and API hashing techniques consistent with China-aligned threat actors.
lab52 ·6mo ago
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
Project CAV3RN is a modular cyberespionage framework targeting entities in Israel, with activity observed since December 2025. A newly identified .NET Native AOT communication module, AzureCommunication.dll, replaces previous HTTP/WebSocket-based C2 by using Microsoft Graph to exchange commands and results via Outlook calendar events. If authentication fails, the module recovers configuration data through DNS AAAA record queries to actor-controlled nameservers. The framework demonstrates advanced resilience and operational continuity through fallback mechanisms and use of legitimate cloud services.
securelist ·1mo ago
HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
HollowGraph is a newly discovered espionage malware that leverages a compromised Microsoft 365 calendar as a covert command-and-control (C2) channel, hiding operator instructions and exfiltrated data within calendar events dated to 2050. The malware uses legitimate Microsoft Graph API traffic to avoid detection, communicating via encrypted attachments on future-dated events. It is associated with the Cavern backdoor framework and shows potential ties to Iranian-linked actors, though attribution remains unconfirmed. The small, targeted footprint suggests focused cyber espionage rather than broad criminal activity.
hacker-news ·1mo ago
Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
An Iranian hacking group linked to the Ministry of Intelligence and Security (MOIS), tracked as Cavern Manticore, has been using a new modular command-and-control (C2) framework named Cavern to target Israeli organizations, particularly in the IT and government sectors. The attack leverages DLL side-loading via SysAid's software update mechanism, deploying a trojanized DLL (uxtheme.dll) that communicates with a C2 server and downloads additional malicious modules. These modules enable reconnaissance, data theft, lateral movement, and tunneling, with a sophisticated .NET-based architecture using mixed compilation formats to hinder analysis. The group exploits trusted relationships in the software supply chain and has shifted from broad reconnaissance to targeted data exfiltration across Middle Eastern sectors.
hacker-news ·1mo ago