OilRig

OilRig is a well-known threat actor in the cybersecurity landscape, notorious for its sophisticated attacks on various targets, including Middle Eastern telecommunications organizations and Israel's critical infrastructure sector. This entity has been linked to several high-profile campaigns such as DarkHydrus, xHunt, SUNBURST, Decoy Dog, and notably, its eponymous OilRig campaign. These campaigns have employed advanced techniques like DNS tunneling for command and control (C2) communications, leveraging legitimate cloud services for their C&C communication, and incorporating novel C2 channels with steganography into their arsenal. The OilRig campaign began testing the ClaySlide delivery documents on November 15, 2016. As part of their modus operandi, OilRig operators use downloaders such as SampleCheck5000 (SC5k), OilBooster, ODAgent, and OilCheck that utilize attacker-controlled cloud service accounts rather than the victim’s internal infrastructure. These downloaders bear similarities with other backdoors in OilRig's toolkit like MrPerfectionManager and PowerExchange, which also use email-based C&C protocols. For instance, SC5k, a C#/.NET application, reports results to the OilRig operators by creating a new email message on the Exchange server and saving it as a draft, thus avoiding detection. Previous research indicates that IT service providers may have been used as pivot points to reach end-target clients in some OilRig APT activities. The group has been active alongside other prominent threat actors like Lazarus Group, Kimusky, APT28, APT29, and Andariel. Furthermore, OilRig has shown a propensity to return to previous victims, as evidenced by the detection of an SC5k version (v3) within an Israeli healthcare organization's network, a known past target of OilRig. This persistence underscores the importance of ongoing vigilance and advanced threat detection mechanisms in cybersecurity defense strategies.