OilRig is an Iranian state-sponsored cyber espionage group linked to Iran's Ministry of Intelligence. The group primarily targets organizations in the Middle East with a focus on government, energy, chemical, and telecommunications sectors. Known for sophisticated spearphishing campaigns, custom DNS tunneling implants, and exploitation of trust relationships. OilRig frequently operates alongside other Iranian groups and shares infrastructure.
ProxyLogon Exchange RCE for PowerExchange deployment
Notable Campaigns
2023
PowerExchange Campaign
Exploitation of Exchange servers using novel PowerShell-based backdoor.
2021
Lyceum/Hexane Overlap
Targeting of Israeli and Tunisian organizations using new backdoors.
2019
HardPass Campaign
LinkedIn-based social engineering targeting aerospace and energy companies.
2017
DNSpionage
DNS hijacking campaign targeting government domains in Middle East.
Detection Engineering
DNS Tunneling via TXT Records
Monitor for high-volume DNS TXT record queries to single domains. Alert on DNS query subdomain lengths exceeding 50 characters. Deploy passive DNS monitoring to identify C2 domain registration patterns. Sigma rule: net_dns_susp_txt_exec_query.
Enable ASR rules to block Office applications from creating child processes. Monitor for WINWORD.EXE or EXCEL.EXE spawning powershell.exe, wscript.exe, or mshta.exe. Sigma rule: proc_creation_win_office_spawn_exe_from_temp.
