Tag: oilrig

4 Attack Reports | 0 Vulnerabilities

Attack reports

BladedFeline: Whispering in the dark

ESET researchers have uncovered a cyberespionage campaign conducted by BladedFeline, an Iran-aligned APT group likely tied to OilRig. The group has been targeting Kurdish and Iraqi government officials since at least 2017, using various malicious tools including reverse tunnels, backdoors, and a ma…

slippery snakelet

Published: June 6, 2025

Downloadable IOCs: 3

Threat Infrastructure Uncovered Before Activation

Between November 2024 and April 2025, a set of domains and servers impersonating an Iraqi academic organization and fictitious UK tech firms were tracked. The infrastructure, while dormant, exhibited characteristics similar to APT34 (OilRig), including shared SSH keys, structured websites, and deco…

domain impersonation

pre-operational staging

Published: April 22, 2025

Downloadable IOCs: 15

Advanced Cyberattacks Against UAE and Gulf Regions

Earth Simnavaz, also known as APT34 and OilRig, has been actively targeting governmental entities in the UAE and Gulf region. The group employs sophisticated tactics, including a backdoor that exploits Microsoft Exchange servers for credential theft and the use of CVE-2024-30088 for privilege escal…

cyber espionage

credential theft

privilege escalation

microsoft exchange

Published: October 14, 2024

Linked vulnerabilities : CVE-2024-30088 (CVSS 7.0)

Downloadable IOCs: 17

Leveraging DNS Tunneling for Tracking and Scanning

This article presents a case study on new applications of domain name system (DNS) tunneling PaloAlto Unit42 have found in the wild. These techniques expand beyond DNS tunneling only for command and control (C2) and virtual private network (VPN) purposes.

trkcdn campaign

Published: May 13, 2024

Downloadable IOCs: 63

Click here to see more Attack Reports