The Iranian nation-state hacking group known as OilRig has been targeting government organizations in the Middle East as part of a cyber espionage campaign. This campaign uses compromised email accounts to send stolen data to external mail accounts controlled by the attackers. This is the first time OilRig has used this technique, showing that they are continuing to evolve their methods to bypass security. The group has been active since 2014 and is linked to the Iranian Ministry of Intelligence and Security. They have been using a variety of tools in their attacks, including backdoors such as Karkoff, Shark, Marlin, and Saitama. The latest activity involves a .NET-based dropper that delivers four different files, including an implant to exfiltrate data. It also uses a dynamic-link library file to harvest credentials from domain users and local accounts. The stolen credentials are then used to send emails to Gmail and Proton Mail accounts controlled by the attackers. The emails are sent via government Exchange Servers using valid accounts with stolen passwords. The connections to APT34 are due to similarities between the first-stage dropper and Saitama, the victimology patterns, and the use of internet-facing exchange servers as a communication method. The increasing number of malicious tools used by OilRig shows their ability to create new malware based on the targeted environment and the privileges they have. Despite the simplicity of the routine, the novelty of the second and last stages suggests that this could be part of a larger campaign targeting governments.
This Cyber News was published on thehackernews.com. Publication date: Fri, 03 Feb 2023 15:41:03 +0000