APT34 / OilRig / Hazel Sandstorm: Inside Iran's Premier Cyber Espionage Group

Executive Summary

APT34 — tracked as OilRig by Palo Alto Unit42, Helix Kitten by CrowdStrike, Hazel Sandstorm by Microsoft, and Earth Simnavaz by Trend Micro — is Iran’s most technically mature and persistently active cyber espionage group. Active since at least 2014, the group has conducted continuous intelligence collection operations against government ministries, energy infrastructure, financial institutions, telecoms providers, and defence contractors across the Middle East, with periodic operations targeting organisations in Europe, the United States, and Asia.

What distinguishes APT34 from other Iranian APT groups is the combination of operational discipline and technical sophistication. The group invests heavily in custom malware development, uses DNS-based command-and-control that is difficult to detect and block at the network perimeter, and maintains long-term access to victim networks measured in months to years. A 2019 data breach by a group calling itself Lab Dookhtegan exposed portions of APT34’s toolset and operational infrastructure — a significant setback from which the group recovered by rebuilding its malware arsenal from the ground up, demonstrating an organisational resilience consistent with state-level resourcing.

Threat Actor Profile

APT34 is assessed with high confidence as an Iran-linked threat actor. Attribution to the Iranian Ministry of Intelligence and Security (MOIS) is assessed at moderate confidence by the majority of vendors, though some researchers have proposed linkage to the IRGC’s cyber arm. The distinction matters for understanding the group’s mandate: MOIS-tasked groups generally focus on intelligence collection, political surveillance, and espionage; IRGC cyber units have a broader mandate that includes offensive disruption capability. APT34’s operations, focused almost exclusively on persistent intelligence access rather than destructive effects, are more consistent with an intelligence-collection mandate.

The group is distinct from MuddyWater (also assessed as MOIS-linked), Charming Kitten/APT42 (IRGC Intelligence Organization), and Pioneer Kitten/Fox Kitten (IRGC). Each of these groups has a different organisational affiliation, targeting set, and technical tradecraft, though there is occasional shared infrastructure suggesting coordination within Iran’s broader cyber enterprise.

APT34’s targeting priorities are consistently tied to Iranian strategic interests: intelligence on Gulf state diplomatic and energy activities, monitoring of opposition and diaspora communities, access to regional financial institutions for economic intelligence, and penetration of telecoms providers that carry communications of interest.

TTPs and Tradecraft

Initial Access

APT34 uses multiple initial access techniques, shifting emphasis over time based on defensive improvements and operational opportunity.

Spear phishing with malicious documents remains a primary vector. Lures are carefully constructed to be plausible for the specific target — job application materials directed at HR staff, industry conference invitations targeting executives, government circular attachments targeting civil servants. Macro-embedded Office documents were the dominant delivery mechanism through 2022; the group subsequently pivoted to exploiting document rendering vulnerabilities and using ISO and LNK-based delivery to bypass macro warning prompts.

Password spraying against internet-facing services has been documented extensively by Microsoft. The group conducts large-scale password spraying campaigns against Microsoft Exchange, Outlook Web Access, Cisco VPN, Fortinet VPN, and cloud identity providers including Entra ID. The approach is slow — typically one or two authentication attempts per account per day to avoid lockout — but persistent and difficult to distinguish from legitimate failed logins without baseline alerting.

Exploitation of public-facing vulnerabilities: APT34 has demonstrated the ability to rapidly operationalise published CVEs affecting internet-facing infrastructure. The group was observed exploiting Microsoft Exchange vulnerabilities (ProxyShell, CVE-2021-34473/34523/31207) within days of public disclosure. In 2024-2026 campaigns tracked by Trend Micro under the Earth Simnavaz designation, the group exploited vulnerabilities in Windows Kernel (CVE-2024-30088, a Local Privilege Escalation vulnerability) and deployed webshells against Exchange servers.

Command and Control: The DNS Signature

APT34’s most distinctive technical characteristic is its heavy reliance on DNS-based command-and-control. Rather than using HTTP or HTTPS callbacks to attacker-controlled infrastructure, implants encode command data in DNS query subdomains and receive responses in DNS TXT, MX, or A records. The approach is effective for several reasons:

DNS traffic is difficult to inspect at scale; most SOCs have limited DNS visibility
DNS queries to attacker-controlled domains blend with legitimate DNS traffic
Many network security tools that block C2 over HTTP do not block DNS-based tunneling
DNS is a necessary service that cannot be blocked at the perimeter without breaking connectivity

The Helminth backdoor, one of APT34’s signature tools, uses DNS tunneling as its primary C2 channel, encoding data in specially crafted subdomain strings. CASHY200, an older APT34 DNS tunneling tool, embeds command data in DNS query subdomain labels with base64 encoding. In more recent campaigns, the group has used legitimate DNS-over-HTTPS (DoH) services as relay infrastructure, routing DNS queries through Cloudflare or Google DoH resolvers to obscure the final destination from network monitoring that watches standard DNS port 53 traffic.

Detecting DNS-based C2 requires:

Monitoring for high-frequency DNS queries with randomised subdomain labels (entropy scoring)
Identifying domains with low TTLs and high unique subdomain counts
Comparing DNS query volumes against per-host baselines
Inspecting TXT record responses for encoded binary data

Lateral Movement and Persistence

APT34 lateral movement relies heavily on credential reuse following successful harvesting. The group’s implants are capable of dumping credentials from LSASS using techniques similar to Mimikatz, extracting saved VPN credentials from Windows Credential Manager, and harvesting browser-saved passwords. Collected credentials are used to authenticate to internal resources — Exchange, file shares, VPN concentrators, remote management tools — without deploying additional tooling.

For persistence, APT34 prefers mechanisms that survive reboots and blend with legitimate system activity:

Scheduled Tasks using names that mimic Windows system tasks (e.g., MicrosoftWindowsUpdate, SystemHealth)
IIS modules (web server modules that execute malicious code when HTTP requests arrive at the web server — the RGDoor backdoor is an APT34 IIS module)
Exchange Transport Agents (server-side email processing components that allow the implant to intercept, modify, or exfiltrate email without requiring network C2 callbacks)

The Exchange Transport Agent technique is particularly notable: by registering a malicious transport agent on a compromised Exchange server, APT34 can maintain persistent access to internal email communications without maintaining a live C2 connection that would appear in network logs. Commands are delivered embedded in specially crafted emails; responses are embedded in email replies.

Malware Arsenal

APT34’s malware portfolio has evolved continuously since the Lab Dookhtegan exposure in 2019 forced the group to retire its previous toolset.

Helminth: The group’s flagship backdoor, available in PowerShell and VBScript variants. Uses DNS tunneling for C2 with fallback to HTTP. Capable of file upload/download, command execution, and process enumeration. The DNS C2 channel encodes commands and responses in subdomain labels of queries to attacker-controlled domains.

SideTwist: A C-based backdoor discovered in 2021. Uses HTTP for C2 (departing from the DNS preference), communicating with a command server via HTTP GET and POST requests that mimic legitimate web traffic. SideTwist is a lighter implant used for initial staging and as a secondary access path alongside Helminth.

LineRunner: A lightweight implant designed specifically for use on Fortinet FortiOS appliances. Exploits the Fortinet file system structure to install a persistent webshell that survives firmware updates — an operationally significant capability, since firmware updates are the standard remediation for compromised appliances. LineRunner was documented by CISA and the NCSC in joint advisories in 2024.

RGDoor: An IIS backdoor module. Registered as an IIS native module (.dll) that processes HTTP requests, enabling the attacker to execute commands via specially crafted web requests to the compromised IIS server. Traffic to the webshell is indistinguishable from normal IIS web traffic in perimeter logs.

LONGWATCH: A keylogger and credential harvester. Captures keystrokes and screenshots and logs them locally for periodic exfiltration via the primary C2 channel.

DNSExfiltrator/CASHY200: Older DNS-based exfiltration tools still observed in some campaigns, likely deployed from legacy playbooks or by operators who have not updated their tooling to current standards.

In 2025-2026 campaigns, Trend Micro documented APT34 (Earth Simnavaz) deploying a new implant via ngrok-based relay infrastructure, using the legitimate tunneling service as a proxy for C2 traffic to bypass perimeter filtering — consistent with the group’s pattern of adapting C2 mechanisms to defeat detection improvements.

2025-2026 Activity

APT34’s operational tempo in 2025-2026 has been high, with multiple confirmed campaigns across the Middle East.

UAE and Gulf state government targeting (2024-2025): Trend Micro documented a campaign attributed to Earth Simnavaz/APT34 targeting UAE government entities and adjacent critical infrastructure organisations. The campaign exploited CVE-2024-30088 for local privilege escalation after gaining initial access via Exchange webshell deployment. The group exfiltrated credentials via Exchange server manipulation and maintained access for extended periods.

Saudi Arabia energy sector targeting: Multiple incident response firms reported APT34-attributed intrusions at Saudi energy companies in 2025, consistent with the group’s long-running interest in Saudi Aramco and the broader Saudi energy sector following its role in the 2012 Shamoon wiper attack (which APT34 may not have conducted but operates in a similar intelligence environment).

Telecoms targeting: The group continued targeting regional telecoms providers as part of a broader Iranian APT pattern (also seen with Weaver Ant and Salt Typhoon from China) of accessing communications infrastructure for intelligence collection. Compromised telecoms infrastructure provides access to calling records, SMS content, and geolocation data for targeted individuals without requiring device-level access.

Microsoft password spray campaigns: Microsoft’s Security Intelligence team documented large-scale password spraying campaigns by Hazel Sandstorm against organisations in the energy, defence, and government sectors across multiple countries. The campaigns targeted Microsoft 365 accounts, with successful authentications providing access to email, SharePoint, and connected cloud resources.

Sector Risk Assessment

Energy and oil and gas: APT34’s highest priority targeting. Saudi Aramco, UAE ADNOC, Kuwaiti and Bahraini national oil companies, and regional pipeline operators have all been targeted. The intelligence interest combines economic data (production levels, pricing information, contract negotiations) with infrastructure intelligence that could be used to plan or support future disruptive operations.

Government and diplomatic: Gulf Cooperation Council member state government ministries, particularly foreign affairs, interior, and defence, are consistent targets. The intelligence value is obvious: diplomatic communications, negotiating positions, and relationships with Western governments and each other.

Financial institutions: Regional banks and financial institutions provide intelligence on economic activity, sanctions compliance, and the financial activities of individuals and organisations of interest to the Iranian state.

Telecoms: Access to call records and SMS content for targeted surveillance of opposition figures, diaspora communities, and individuals of interest to Iranian intelligence.

Defence contractors: Organisations supporting Gulf state military procurement or operating in the defence industrial base are targeted for intelligence on weapons systems, procurement decisions, and defence capabilities.

Detection

DNS Anomaly Detection

High-entropy subdomains in DNS queries are the primary indicator of Helminth and CASHY200 C2 activity. Implement entropy scoring on DNS query subdomains and alert on:

Queries to domains with subdomains exhibiting character entropy > 3.5 bits/character
Single domains receiving more than 50 unique subdomain queries per day from a single host
DNS TXT record responses with base64-encoded content exceeding 500 characters

Exchange and IIS Monitoring

For RGDoor and related IIS modules:

// Detect new IIS module DLL registrations
SecurityEvent
| where EventID == 4657  // Registry value set
| where ObjectName contains "W3SVC\\Parameters\\Filter DLLs" 
   or ObjectName contains "MsExchangeTransport"
| project TimeGenerated, Account, ObjectName, ObjectValueName, ProcessName

Fortinet Firmware Persistence Check

If LineRunner is a concern in your environment (Fortinet FortiOS appliances):

After applying firmware updates, verify that unexpected files do not persist in /tmp/ or the FortiOS virtual filesystem
Monitor FortiGate management logs for unexpected scheduled task creation or file system access from the CLI

Password Spray Detection

// Detect password spraying pattern: many failures across many accounts from single IP
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType != 0  // Failed authentications
| summarize FailedAccounts = dcount(UserPrincipalName), FailedAttempts = count() by IPAddress
| where FailedAccounts > 20 and FailedAttempts > 50
| project IPAddress, FailedAccounts, FailedAttempts
| order by FailedAccounts desc

Historical Context: Lab Dookhtegan and the 2019 Exposure

In April 2019, a Telegram channel calling itself Lab Dookhtegan leaked significant portions of APT34’s toolset, including source code for Helminth, LONGWATCH, and other tools, along with a list of compromised victims (over 66 organisations across 14 countries) and photographs purportedly of APT34 operators. The leak caused demonstrable operational disruption: victim organisations became aware of the compromise, C2 infrastructure was burned, and tools were exposed to vendor analysis.

APT34’s recovery from the 2019 exposure is the most significant evidence of its state-backed resourcing. Within approximately six months, the group had developed new implant variants, rebuilt C2 infrastructure, and resumed operations at scale. No organic criminal group could absorb that disruption and rebuild at that pace. The recovery demonstrates an organisational structure capable of long-term continuity — developers, operators, and infrastructure that exists independently of any specific toolset or campaign.