OilRig
IntrusionSet · ATTACK:enterprise:G0049
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0049",
"title": "OilRig",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0049",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
"external_id": "G0049",
"domain": "enterprise",
"created": "2017-12-14T16:46:06.044Z",
"modified": "2026-07-31T20:48:34.886Z",
"version": "5.0",
"aliases": [
"OilRig",
"COBALT GYPSY",
"IRN2",
"APT34",
"Helix Kitten",
"Evasive Serpens",
"Hazel Sandstorm",
"EUROPIUM",
"ITG13",
"Earth Simnavaz",
"Crambus",
"TA452"
],
"tactics": [
],
"source_references": [
{
"source_name": "IRN2"
},
{
"source_name": "ITG13"
},
{
"source_name": "Hazel Sandstorm"
},
{
"source_name": "EUROPIUM"
},
{
"source_name": "OilRig"
},
{
"source_name": "TA452"
},
{
"source_name": "COBALT GYPSY"
},
{
"source_name": "Crambus"
},
{
"source_name": "Earth Simnavaz"
},
{
"source_name": "Helix Kitten"
},
{
"source_name": "Evasive Serpens"
},
{
"source_name": "Check Point APT34 April 2021",
"url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
},
{
"source_name": "ClearSky OilRig Jan 2017",
"url": "http://www.clearskysec.com/oilrig/"
},
{
"source_name": "Trend Micro Earth Simnavaz October 2024",
"url": "https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"
},
{
"source_name": "Palo Alto OilRig May 2016",
"url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
},
{
"source_name": "Palo Alto OilRig April 2017",
"url": "http://researchcenter.paloaltonetworks.com/2017/04/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/"
},
{
"source_name": "Palo Alto OilRig Oct 2016",
"url": "http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"
},
{
"source_name": "IBM ZeroCleare Wiper December 2019",
"url": "https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"
},
{
"source_name": "Unit 42 QUADAGENT July 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
},
{
"source_name": "Crowdstrike Helix Kitten Nov 2018",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint Iranian Aligned Attacks JAN 2020",
"url": "https://www.proofpoint.com/us/corporate-blog/post/iranian-state-sponsored-and-aligned-attacks-what-you-need-know-and-steps-protect"
},
{
"source_name": "FireEye APT34 Dec 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
},
{
"source_name": "Secureworks COBALT GYPSY Threat Profile",
"url": "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy"
},
{
"source_name": "Symantec Crambus OCT 2023",
"url": "https://www.security.com/threat-intelligence/crambus-middle-east-government"
},
{
"source_name": "APT34"
},
{
"source_name": "Unit 42 Playbook Dec 2017",
"url": "https://pan-unit42.github.io/playbook_viewer/"
},
{
"source_name": "Unit42 OilRig Playbook 2023",
"url": "https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"
}
]
}Explicit source assertions (108)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00c88cab-5cb9-492a-8dce-8eab92213bc3
OilRig New Delivery Oct 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1588.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00dd8854-0018-4229-a330-8c71f5421123
ClearSky OilRig Jan 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--024593ae-03a1-4ffa-a5fc-fc2fe43e6ebf
FireEye APT34 July 2019ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S1170
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04f9325e-3fdb-4293-92ca-19e4b85977a2
ESET OilRig Downloaders DEC 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0495
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0783831d-da64-4bb3-a54e-c5149e7e0d76
Unit42 RDAT July 2020ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c03f2b4-a752-4d74-9c26-5306132a3329
FireEye APT34 July 2019 · Check Point APT34 April 2021 · Palo Alto OilRig May 2016 · Palo Alto OilRig Oct 2016 · Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0096
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e6d61e2-7b61-4b6c-85c7-7779125c1d14
FireEye APT34 Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0fa0f5d6-be0b-4a48-938c-6d9bb8b1a170
FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · FireEye APT35 2018 · Unit42 OilRig Playbook 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12daddcc-b964-485e-8c2d-10f554d78bcc
OilRig ISMAgent July 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0269
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1652bf3a-085a-4388-839a-04858b14affd
Unit 42 QUADAGENT July 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--166326b3-6864-4667-aee9-4d7b24cc75d8
FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · Unit42 OilRig Playbook 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16d0869c-1ed4-48b9-92f9-cae22e7a001f
Trend Micro Earth Simnavaz October 2024ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1686.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fc6a16e-a595-4c72-9e2f-ca9acfbe62f7
Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26cee727-2047-4ea9-b3bd-1115431aa633
FireEye APT34 Dec 2017 · OilRig ISMAgent July 2017 · Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · Unit42 OilRig Nov 2018 · FireEye APT34 Dec 2017 · OilRig ISMAgent July 2017 · Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · Unit42 OilRig Nov 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27ead6bc-2bba-49d3-bcfe-667c7654a6fc
Crowdstrike GTR2020 Mar 2020 · FireEye APT34 Webinar Dec 2017 · Symantec Crambus OCT 2023 · Unit42 OilRig Playbook 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dbed740-1b50-4d59-a729-a1d9e6a839df
Crowdstrike GTR2020 Mar 2020 · FireEye APT34 Webinar Dec 2017 · Trend Micro Earth Simnavaz October 2024 · Unit42 OilRig Playbook 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e5fbe0a-9cdd-4df2-8061-617075b045fd
ESET OilRig Downloaders DEC 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f19d354-898b-4c42-b3f2-dd45e52423dc
ClearSky OilRig Jan 2017ATTACK:enterprise:C0042 → attributed-to → ATTACK:enterprise:G0049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f87d195-6eb2-49d2-8dcf-a7bd4163cd09
ESET OilRig Campaigns Sep 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ffc25c4-3939-40df-841c-91059c6879d4
Check Point APT34 April 2021ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30854ead-6837-413b-bb8e-fcca45b95dc0
Trend Micro Earth Simnavaz October 2024ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0264
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3127bcf3-3638-4c1b-9a95-156f6c78658a
Unit 42 OopsIE! Feb 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1218.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--352e990d-48be-4d1a-bd8a-bc27d641aa1f
Palo Alto OilRig May 2016ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0508
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--392d928f-a05b-42d3-9294-bc0f074a30b2
Trend Micro Earth Simnavaz October 2024ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--393a3ec4-9970-44ab-ae63-1e9c6bed0310
FireEye APT34 Webinar Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39ce32d3-7721-4008-b74d-3549b7bb8fa7
Palo Alto OilRig May 2016ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3beb0c09-e584-4fd8-92bb-d7a1ae9192e6
Palo Alto OilRig May 2016 · FireEye APT34 Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1137.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c367277-6168-4df8-b982-e9949994123d
FireEye Outlook Dec 2019ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fb836b7-41cf-40d1-bd56-14e45e6bbd02
Palo Alto OilRig May 2016 · FireEye APT34 Dec 2017 · Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--409581f2-270d-43ce-8044-34bc09874548
Palo Alto OilRig May 2016ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0160
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--431ec495-5f92-40e9-9955-58ca334ea3c8
FireEye APT34 Dec 2017 · Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S1151
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45159cd3-3e77-433b-a9ea-388875655103
IBM ZeroCleare Wiper December 2019ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45cd89d8-68fd-42a2-94ba-7796a696bc47
FireEye APT34 Webinar Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1025
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46396855-3e2e-428e-95b6-1888007fd393
Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4923be5e-dd24-4289-adca-e9dbf545b9c2
Palo Alto OilRig May 2016ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0075
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49404706-aa42-4914-a273-2eeb217e6477
Palo Alto OilRig May 2016 · FireEye APT34 Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1556.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c215a47-b170-429d-a62f-b2c43b8f7a1f
Trend Micro Earth Simnavaz October 2024ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fde23ab-b8db-4275-ac37-37e608cb00b0
Trend Micro Earth Simnavaz October 2024 · OilRig New Delivery Oct 2017 · Crowdstrike Helix Kitten Nov 2018 · FireEye APT34 Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51f1d23c-1ccd-4cc4-918c-39e9a66e510b
FireEye APT34 Dec 2017 · Unit 42 OopsIE! Feb 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--526837ff-672d-4afa-899e-3634b19bab14
Trend Micro Earth Simnavaz October 2024 · Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0184
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52d3e8a9-8801-497f-b1e1-6d45e196c79b
FireEye APT34 Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--557d3feb-0699-429e-bc83-ff114cf138ef
Check Point APT34 April 2021 · ClearSky OilRig Jan 2017 · Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · Crowdstrike Helix Kitten Nov 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55e34506-746d-4895-928b-72c2e358161d
FireEye APT34 Webinar Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5744b31d-6633-44ca-8170-17489fec124c
Palo Alto OilRig May 2016 · FireEye APT34 Dec 2017 · Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ca26415-3f7b-4885-9430-1034665872d7
Trend Micro Earth Simnavaz October 2024ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1201
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e39caf2-083b-4e4c-b04f-d83c512341cb
FireEye Targeted Attacks Middle East BanksATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ea45077-b2a0-48ce-9ae7-30ad56d0b4a6
ClearSky OilRig Jan 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f5af879-c239-416b-99ec-b46e2f9926a2
Palo Alto OilRig May 2016ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1003.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65b58e05-916b-4840-b0a0-bb7fd8dc3f32
FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · FireEye APT35 2018 · Unit42 OilRig Playbook 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67469b79-67e2-4932-9776-b09a82871723
FireEye APT34 Dec 2017 · OilRig New Delivery Oct 2017 · Unit 42 OopsIE! Feb 2018 · Crowdstrike GTR2020 Mar 2020ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a9c1a1d-f435-422c-b990-d48eb0a87d3e
ClearSky OilRig Jan 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S1166
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6adeaf40-84a6-4334-b15c-fc740e07b7ce
ESET OilRig Campaigns Sep 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70495f42-0a81-485c-8f30-c75af61f1c6a
Trend Micro Earth Simnavaz October 2024 · Palo Alto OilRig Oct 2016ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0100
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72d6fe7e-ba33-4117-8153-64226f189ed2
Palo Alto OilRig May 2016ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f7226d7-6980-402a-b10e-e81b50c7ee09
FireEye APT34 Webinar Dec 2017 · IBM ZeroCleare Wiper December 2019ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f80cb84-3cb5-4de3-a484-1c0a60e2dbcf
Check Point APT34 April 2021ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8272bde7-817f-4cb4-b073-67859002d310
ClearSky OilRig Jan 2017 · Unit 42 OopsIE! Feb 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0349
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b42462a-0d66-4740-8f48-0857ab523370
FireEye APT35 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cb570d9-34be-40a7-9ef5-5ab34d89d476
Trend Micro Earth Simnavaz October 2024 · Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dd1ec07-e429-473d-84db-125fd22ab709
Check Point APT34 April 2021ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dfb6f79-5a9a-4eb8-9b25-40d82ff0f668
FireEye APT34 July 2019 · Check Point APT34 April 2021 · FireEye APT34 Webinar Dec 2017 · Unit42 OilRig Playbook 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e9f95f0-4939-4e74-9073-70efddddff50
Trend Micro Earth Simnavaz October 2024 · FireEye APT34 Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8edb0383-cae8-43ee-9241-b25e5068cc95
Palo Alto OilRig May 2016ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92666157-324b-4f15-9be2-9a0711351125
Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1195
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93056830-b48c-4b60-8edf-7f143ce6dd70
Trend Micro Earth Simnavaz October 2024ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--952edf61-e906-4ab5-989f-1d6a5dd95dce
ClearSky OilRig Jan 2017 · Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · Crowdstrike Helix Kitten Nov 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9779ccbc-c376-4a6e-a43f-56a782892302
Crowdstrike GTR2020 Mar 2020 · FireEye APT34 Webinar Dec 2017 · IBM ZeroCleare Wiper December 2019 · Unit42 OilRig Playbook 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0360
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--978d8c12-bf39-440f-ac17-b66970451152
FireEye APT34 Dec 2017 · Palo Alto OilRig Sep 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99686b3a-1ca4-4b36-ad4d-a8876d8c65ba
FireEye APT34 Webinar Dec 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0610
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99ec87aa-5e07-4d47-8d29-6614850c88b5
Check Point APT34 April 2021ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a025d011-6e46-4d3a-a9f7-31324027b7cf
ClearSky OilRig Jan 2017 · Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · Crowdstrike Helix Kitten Nov 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1e16836-d6d9-4d47-bb9a-35f31f369980
Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · FireEye APT34 July 2019 · Check Point APT34 April 2021ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a24299ed-9735-453c-bd13-66269b2d5d16
Unit42 OilRig Playbook 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7f1c958-3e05-4dcf-9c17-ffead29a72df
ClearSky OilRig Jan 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8d7e4da-53d8-45c2-8c87-70424d96a949
FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--add011d8-6cd3-4ae5-af51-e52ce81e277a
Symantec Crambus OCT 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0170
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae1de9c5-6bc0-459a-b4ca-568139a5ee41
Palo Alto OilRig May 2016 · FireEye APT34 Webinar Dec 2017 · Crowdstrike Helix Kitten Nov 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b22cebe6-129a-41a2-8a9e-70c222c88af6
Palo Alto OilRig May 2016 · Palo Alto OilRig Oct 2016 · Check Point APT34 April 2021ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3d6abc5-11da-4d0c-a699-8cafac03dfab
FireEye APT34 July 2019ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6c44630-d1d0-467c-a84d-83564a3a0639
FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · Symantec Crambus OCT 2023 · Unit42 OilRig Playbook 2023