Executive Summary
OilRig — tracked across the industry under the aliases APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, Earth Simnavaz, COBALT GYPSY, and EUROPIUM — is one of the most enduring and consistently active cyber espionage operations attributed to Iranian state interests. Active since at least 2014, the group has demonstrated sustained targeting of government, energy, telecommunications, and financial sectors across the Middle East, with periodic campaigns extending into Europe, Southeast Asia, and the Americas.
Unlike some Iranian APT operations that surge and fade with geopolitical events, OilRig has maintained near-continuous activity across more than a decade. It operates a deep custom toolset that has evolved substantially over time, recently incorporating trusted cloud platform abuse and steganographic C2 concealment techniques that represent a meaningful operational upgrade from its earlier tradecraft.
The group’s primary intelligence mandate appears oriented toward Saudi Arabia and the broader Gulf region, Israel, and US-aligned government and military contractors — a targeting portfolio consistent with strategic collection priorities of the Iranian Ministry of Intelligence and Security (MOIS) or associated elements of the Islamic Revolutionary Guard Corps (IRGC) intelligence apparatus.
Group Profile
OilRig first came to broad industry attention in 2016 through Palo Alto Unit 42’s tracking of campaigns against Saudi Arabian organisations. The group’s name derives from early targeting of oil and gas sector targets in the Gulf region, though the portfolio has expanded well beyond that vertical.
The group’s operational security has improved significantly since its earlier years. A damaging operational setback in 2019 — when a disgruntled individual associated with the group published tooling, infrastructure details, and victim data on Telegram channels operated under the name “Lab Dookhtegan” — exposed a significant body of OilRig tradecraft and forced the group to rebuild portions of its toolkit. The response was methodical: deprecated tools were replaced with new custom malware, infrastructure was rotated, and C2 mechanisms shifted to abuse of legitimate cloud services that are harder to block at the network perimeter.
The group’s precise government relationship is not publicly confirmed with the same specificity as Sandworm’s GRU attribution or APT42’s IRGC-IO attribution. Multiple vendors assess OilRig as MOIS-affiliated; others place certain subclusters within the broader IRGC intelligence apparatus. The targeting pattern — national security, diplomatic, economic intelligence — is consistent with MOIS collection priorities, as is the persistent focus on adversaries of Iranian state interests rather than financial motivation.
Targeting
OilRig’s primary target set has remained stable across its operational history:
Energy and oil/gas organisations throughout the Gulf, particularly Saudi Arabia (Saudi Aramco and affiliated companies have been persistent targets), UAE, Kuwait, and Qatar. The strategic logic is direct: disrupting or surveilling hydrocarbon infrastructure is both economic and geopolitical leverage.
Telecommunications and ISPs across the Middle East. Telecom access provides metadata visibility across communications at scale — a high-value collection capability. This targeting extends to submarine cable operators and regional internet exchange points.
Government and diplomatic targets including foreign ministries, defence contractors, and organisations with visibility into Iran’s external environment. This has included targets in Jordan, Iraq, Turkey, and — with increasing intensity through 2025-2026 — Israel.
Financial institutions including central banks and sovereign wealth fund infrastructure in Gulf states.
Beyond the Middle East, OilRig has conducted operations against targets in the United States, Europe (particularly UK and Germany), and South Asia, generally in support of collection against organisations with relationships to its primary target set.
Malware Ecosystem
OilRig operates one of the more extensive custom malware ecosystems of any state-sponsored APT group. The toolkit has evolved substantially over time and is notable for the willingness to develop and deploy new tools when existing capabilities are burned.
Helminth was the group’s original signature backdoor — a dual-component implant using both DNS and HTTP channels for C2. DNS-based exfiltration encoded data as subdomains of attacker-controlled domains, allowing data to traverse perimeters that blocked direct outbound HTTP. Helminth is no longer actively deployed in its original form following the 2019 tool exposure, but its design influenced successor implants.
QUADAGENT is a PowerShell-based backdoor that used PowerShell’s legitimate execution capabilities to blend into normal administrative traffic. It communicated via scheduled task execution and encoded output in base64 before exfiltrating via DNS or HTTP. Its use reflects the group’s early adoption of “living off the land” approaches.
ISMAgent (also documented as ISMDoor/ISMInjector) is a .NET backdoor that established persistence via scheduled tasks and communicated over DNS to hardcoded C2 infrastructure.
SIDETWIST is a lighter-weight C backdoor used for initial persistence, designed to download and execute more capable second-stage payloads once an initial foothold is established. It has appeared in campaigns targeting Israeli organisations from 2022 onward.
STEALHOOK is OilRig’s primary 2024-2026 capability. A sophisticated information-stealing backdoor, STEALHOOK is deployed after privilege escalation — in documented 2026 cases, through exploitation of Windows Kernel vulnerability CVE-2024-30088 to achieve SYSTEM-level access. Once deployed, STEALHOOK exfiltrates data from Outlook PST/OST files and connected Exchange servers, targeting email communications as a primary intelligence source. Email content from government and diplomatic accounts has historically been among the highest-value targets for the group.
BANANAMAIL and related mail-centric tooling reflect the group’s sustained interest in email as a collection vector — both for intelligence and for building spearphishing relationships with new targets.
Tradecraft and TTPs
OilRig’s technique evolution reflects a consistent response to detection: when a method is published or burned, the group adapts rather than persisting with compromised tooling.
Initial Access
The primary initial access vector remains spearphishing with context-specific lures. OilRig has demonstrated particularly disciplined lure construction — documents reference real organisations, real personnel, and operationally relevant content that suggests prior open-source research on targets. In 2026 campaigns, geopolitical lures including documents referencing Iranian protest movements have been used to target Israeli organisations.
Credential-based access through password spraying against publicly accessible services (OWA, VPN portals, RDP) has been consistently documented. The group is patient in credential operations — targeting a set of accounts over extended periods rather than high-volume sprays that trigger lockout thresholds.
Exploitation of public-facing applications has included known CVEs in Exchange, VPN platforms, and web application frameworks, typically within weeks of public disclosure.
Command and Control Evolution
The most strategically significant evolution in OilRig tradecraft has been the shift away from dedicated C2 infrastructure toward trusted cloud service abuse. This approach makes network-level detection and blocking substantially harder.
Earlier OilRig operations used dedicated DNS C2 infrastructure — attacker-controlled domains queried via encoded subdomain strings. This technique, while effective against perimeter controls without DNS logging, became well-documented and detectable through DNS traffic analysis.
The transition to Google Drive, Microsoft Exchange Online, and cloud storage services as C2 channels represents a meaningful operational upgrade. In the steganography-based technique documented in 2026, OilRig concealed malware configuration data inside images hosted on Google Drive. The malware downloaded seemingly innocuous image files, extracted configuration from hidden data embedded in pixel values or metadata, and used that configuration to direct its operations — all while the network traffic appeared to be routine Google service access.
Exchange Online has similarly been used as a mail-based C2 channel: malware reads drafts or specific folders in a compromised mailbox for commands, writes results to another folder, and operators interact through the legitimate Exchange interface. This “mail dead drop” technique was documented as early as 2021 in OilRig operations and remains in active use.
Persistence and Privilege Escalation
Web shell deployment on internet-facing infrastructure is a consistent OilRig persistence mechanism. IIS and Exchange web shells have appeared in documented intrusions, providing reliable re-entry points even if initial access credentials are changed.
Scheduled task creation for backdoor execution is the most common host persistence method across OilRig’s malware variants.
Privilege escalation has followed a pattern of exploiting kernel vulnerabilities shortly after public disclosure. CVE-2024-30088 (Windows Kernel elevation of privilege) was observed in 2026 campaigns — a pattern the group has followed with previous kernel CVEs. The capability to quickly operationalise privilege escalation exploits suggests either dedicated exploit development capacity or access to exploit acquisition pipelines.
Defense Evasion
The steganography technique documented in 2026 represents the group’s most operationally sophisticated evasion approach. By storing configuration in image files on legitimate cloud infrastructure, OilRig reduces the number of connections to attacker-controlled infrastructure that could trigger detection alerts. The malware itself may make no outbound connection to flagged IPs or domains — only to Google’s IP ranges.
PowerShell-based tooling has been obfuscated across multiple encoding layers. The group uses AMSI bypass techniques and has adapted its PowerShell tooling in response to published detection coverage.
Historical Incidents and Impact
The 2019 Lab Dookhtegan exposure provided rare visibility into OilRig’s operations at the time. The leaked data — which included source code for deployed tools, victim lists, and attacker infrastructure details — revealed active compromises in dozens of organisations across government, telecoms, and financial sectors in the Middle East. The victims included national telecommunications providers, energy companies, and government ministries across multiple Gulf states, reflecting the breadth of the group’s sustained access during that period.
Post-2019 campaigns have demonstrated that the operational setback was temporary. By 2021, new tooling was documented in fresh campaigns against the same target verticals, suggesting maintained access and intelligence on prior collection gaps that drove targeting priorities.
The 2024-2026 Israel focus — with STEALHOOK deployments and SIDETWIST campaigns using protest-themed lures — reflects the heightened geopolitical tension in the Iran-Israel relationship and a specific intelligence priority around Israeli government, military, and diplomatic communications.
Defensive Implications
DNS logging remains foundational. OilRig’s earlier DNS C2 tradecraft — and the tradecraft of groups that will follow similar patterns — is detectable only through comprehensive DNS query logging and analysis. Organisations operating in the target verticals should have full DNS visibility, query anomaly detection, and baseline profiles for unusual domain resolution patterns.
Cloud service traffic is not inherently safe traffic. The shift to Google Drive and Exchange Online for C2 requires detection approaches that go beyond blocking known-bad IPs and domains. DLP controls that inspect file downloads from cloud storage, anomaly detection on Exchange access patterns (particularly off-hours mailbox folder access), and endpoint behavioural monitoring that flags image file downloads followed by unusual process activity are all relevant controls.
Privilege escalation monitoring should include tracking for kernel exploit indicators, particularly around recently disclosed Windows kernel CVEs. OilRig’s pattern of rapid CVE operationalisation means that in-the-wild exploitation follows public disclosure by days to weeks, not months.
Email security controls that protect Exchange infrastructure — offline access to PST files, administrative access to Exchange APIs, MAPI connection monitoring — are relevant given STEALHOOK’s focus on email exfiltration. The combination of an identity-based threat (compromised privileged credentials) and an email exfiltration tool capable of accessing archived mail means that years of email history can be exfiltrated in a single intrusion.
Spearphishing training tailored to the specific lure patterns OilRig uses — context-appropriate document lures referencing real organisations, professionally formatted — is more valuable than generic phishing awareness training, which will not prepare users for the quality of social engineering this group deploys.