Home › Threat Actors › APT34
← All Threat Actors
Nation-State high Iran

APT34

Iran — assessed with high confidence as an Iran-linked state threat actor; attribution to the Ministry of Intelligence and Security (MOIS) assessed at moderate confidence by most vendors, with some researchers proposing IRGC cyber-arm linkage · Espionage / long-term intelligence collection in support of Iranian strategic interests (not destructive/disruptive)

Reports 2
Active Since 2014
Last Reported 17 Aug 2026
Sectors Targeted energy, communications, government, financial-services, critical-infrastructure, finance

Tactics, Techniques & Procedures (TTPs)

  • Spear phishing with target-tailored malicious documents (macro-embedded Office docs through 2022, later ISO/LNK delivery to bypass macro warnings)
  • Large-scale, low-and-slow password spraying against Exchange/OWA, Cisco and Fortinet VPNs, and Entra ID
  • Rapid operationalization of public-facing CVEs (e.g. Exchange ProxyShell CVE-2021-34473/34523/31207; Windows Kernel LPE CVE-2024-30088)
  • DNS-based C2 encoding commands/responses in subdomain labels (Helminth, CASHY200), including relay via legitimate DNS-over-HTTPS resolvers
  • ngrok-based relay infrastructure for C2 in 2025-2026 campaigns
  • Credential dumping from LSASS and Windows Credential Manager/browsers for lateral movement without extra tooling
  • Persistence via disguised Scheduled Tasks, malicious IIS modules (RGDoor), and malicious Exchange Transport Agents for covert email-based command delivery
  • Context-specific, well-researched spearphishing lures (incl. 2026 Iranian-protest-themed lures targeting Israeli organisations)
  • Patient, low-volume password spraying against OWA, VPN portals, and RDP to avoid lockout thresholds
  • Rapid exploitation of disclosed CVEs in Exchange, VPN platforms, and web application frameworks, including Windows Kernel EoP CVE-2024-30088 for SYSTEM-level access
  • Shift from dedicated DNS C2 to abuse of trusted cloud platforms: steganographic config data hidden in Google Drive-hosted images, and Exchange Online 'mail dead drop' C2 (commands/results via mailbox folders)
  • Web shell deployment on IIS/Exchange for durable re-entry
  • Scheduled-task-based persistence; multi-layer PowerShell obfuscation with AMSI bypass
  • STEALHOOK: post-privilege-escalation info-stealer exfiltrating Outlook PST/OST and Exchange mail data

Known Targets

Energy/oil & gas (Saudi Aramco, UAE ADNOC, Kuwaiti/Bahraini national oil companies)Gulf government and diplomatic ministries (foreign affairs, interior, defence)Regional financial institutionsTelecoms providers across the Middle EastDefence contractors supporting Gulf military procurementEnergy/oil & gas across the Gulf (Saudi Aramco and affiliates, UAE, Kuwait, Qatar)Telecommunications/ISPs and submarine cable operators across the Middle EastGovernment and diplomatic targets (Jordan, Iraq, Turkey; intensified Israel targeting 2025-2026)Financial institutions incl. Gulf central banks and sovereign wealth fund infrastructureSecondary targeting in the US, UK, Germany, and South Asia

Analyst Notes

Iran's most technically mature, persistently active espionage group; distinguishing signature is heavy reliance on DNS tunneling C2 (Helminth, CASHY200). Exposed in April 2019 by a leaker calling itself 'Lab Dookhtegan' (source code, infrastructure, 66+ victims across 14 countries leaked), but rebuilt its entire toolset within ~6 months. 2025-2026 activity includes UAE/Gulf government intrusions via Exchange webshells + CVE-2024-30088 privilege escalation, Saudi energy-sector intrusions, and continued telecom targeting. Additional reporting: Same operational lineage as the APT34 entry (first drew industry attention via Unit42 tracking of Saudi-targeted campaigns from 2016). This article emphasizes the group's most recent tradecraft evolution: abandoning dedicated DNS C2 infrastructure in favor of Google Drive steganography and Exchange Online mail dead-drops, and a 2024-2026 pivot toward intensified Israel-focused operations using the STEALHOOK and SIDETWIST implants. Also references the 2019 Lab Dookhtegan leak as the catalyst for the group's toolkit overhaul.

Also Known As

OilRigHelix KittenHazel SandstormEarth SimnavazAPT34Evasive SerpensCOBALT GYPSYEUROPIUM

MITRE ATT&CK Techniques

T1566.001 Phishing: Spearphishing Attachment T1110.003 Brute Force: Password Spraying T1071.004 Application Layer Protocol: DNS T1053.005 Scheduled Task/Job: Scheduled Task T1505.003 Server Software Component: Web Shell T1003.001 OS Credential Dumping: LSASS Memory T1102 Web Service T1114.002 Email Collection: Remote Email Collection T1027.003 Obfuscated Files or Information: Steganography

Intelligence Reports

Analysis energycommunications

OilRig (APT34): Iran's Most Persistent Cyber Espionage Operation

OilRig has maintained one of the longest continuous cyber espionage campaigns of any state-aligned threat actor, targeting energy, telecoms, government, and financial sectors across the Middle East and beyond for over a decade. A full profile of TTPs, malware ecosystem, and 2026 campaign activity.

17 Aug 2026 · 11 min read
Analysis critical-infrastructurefinance

APT34 / OilRig / Hazel Sandstorm: Inside Iran's Premier Cyber Espionage Group

APT34 has operated persistently since at least 2014, targeting energy, government, financial, and telecoms sectors across the Middle East and beyond. Known for DNS-based command-and-control, a continuously evolving malware arsenal, and deep operational persistence, the group represents Iran's most capable and consistently active espionage platform. This deep-dive covers APT34's organisational profile, TTPs, malware families, and 2025-2026 activity.

5 Aug 2026 · 15 min read