Quick links
Press Enter to search, Esc to close
Threat group profile
MITRE ATT&CK describes OilRig, also tracked as APT34, as a suspected Iranian group working on behalf of the Iranian government since at least 2014, and the UAE Cyber Security Council issued advisories on it in October and December 2024.
In short
MITRE ATT&CK describes OilRig, also tracked as APT34, as a suspected Iranian group working on behalf of the Iranian government since at least 2014, and the UAE Cyber Security Council issued advisories on it in October and December 2024. MITRE and the UAE council list government, energy, financial, chemical and telecoms targets mainly in the Middle East, reached through phishing emails and stolen logins.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| OilRig | MITRE ATT&CK group page title; also UAE Cyber Security Council advisory of 26 December 2024[1, 3] |
| COBALT GYPSY | MITRE ATT&CK Associated Groups list[1] |
| IRN2 | MITRE ATT&CK Associated Groups list[1] |
| APT34 | MITRE ATT&CK Associated Groups list; also UAE Cyber Security Council advisories of 2024[1, 2, 3] |
| Helix Kitten | MITRE ATT&CK Associated Groups list; also UAE Cyber Security Council advisory of 26 December 2024 and the 2019 CISA alert (written HELIX KITTEN)[1, 3, 5] |
| Evasive Serpens | MITRE ATT&CK Associated Groups list[1] |
| Hazel Sandstorm | MITRE ATT&CK Associated Groups list[1] |
| EUROPIUM | MITRE ATT&CK Associated Groups list[1] |
| ITG13 | MITRE ATT&CK Associated Groups list[1] |
| Earth Simnavaz | MITRE ATT&CK Associated Groups list; also UAE Cyber Security Council advisory of 14 October 2024[1, 2] |
| Crambus | MITRE ATT&CK Associated Groups list; also the 2019 NCSC UK advisory (written OilRig/Crambus)[1, 4] |
| TA452 | MITRE ATT&CK Associated Groups list[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page version 5.0, last modified 31 July 2026
Describes OilRig as a suspected Iranian threat group working on behalf of the Iranian government, judging by infrastructure details with references to Iran, use of Iranian infrastructure and targeting that fits nation-state interests.[1]
MITRE ATT&CK Page version 5.0, last modified 31 July 2026
Says the groups once tracked separately as APT34 and OilRig were combined after further reporting raised confidence that the activity overlapped.[1]
UAE Cyber Security Council 14 October 2024
Reported a recent campaign by Earth Simnavaz (APT34, OilRig) against critical infrastructure, mainly energy, in the UAE and the wider Gulf. It names no country behind the group.[2]
UAE Cyber Security Council 26 December 2024
Said OilRig, also known as APT34 or Helix Kitten, is a threat actor that targets critical sectors in the Middle East and has been active since at least 2016. It names no country behind the group.[3]
MITRE ATT&CK January to December 2021
Attributes the Outer Space campaign, with the Solar backdoor against Israeli organizations, to OilRig.[6]
MITRE ATT&CK January to December 2022
Attributes the Juicy Mix campaign, with the Mango backdoor against Israeli organizations, to OilRig.[7]
MITRE ATT&CK Page for software S1173
Says OilRig has used the PowerExchange backdoor since at least 2023, including against government targets in the Middle East.[10]
NCSC UK, with the US NSA 21 October 2019
In the Turla advisory, said others in the security community attribute a Middle East victim's control panel to APT34 (also known as OilRig/Crambus). It names no agency behind the group.[4]
CISA Last revised 23 October 2019
Its alert names APT 34, known as HELIX KITTEN or OilRig, as an Iranian APT group, and says activity that seems to come from it may be Turla.[5]
National Cyber Security Center, Bahrain 15 June 2022
Says some activities of the Iranian actor Lyceum are related to APT34 aka OilRig. This is a link between two actors, not an attribution of OilRig itself.[23]
CERT-EU 2019 entry
In its 10 Years Edition report, repeats the NCSC UK and NSA statement that Turla used the Iranian APT34's tools and infrastructure.[24]
Sources differ on how long the group has been active. MITRE ATT&CK says OilRig has targeted victims since at least 2014. The UAE Cyber Security Council advisory of 26 December 2024 says at least 2016. Sources also differ on naming a state. MITRE says the group works on behalf of the Iranian government. The two UAE Cyber Security Council advisories name the group and its tools but do not name a country or agency, and no source used here names an Iranian agency. CISA and the NCSC UK name the group only inside a Turla advisory and say others in the security community made the link.
Each entry is attributed to the group by the sources cited.
MITRE ATT&CK says OilRig has targeted Middle Eastern and international victims since at least 2014.[1]
The UAE Cyber Security Council says the group has been active since at least 2016. Sources differ on the start year.[3]
MITRE says this PowerShell backdoor was first observed while targeting a Middle Eastern government organization.[8]
The UAE Cyber Security Council lists a QUADAGENT campaign in 2018.[3]
MITRE says an updated version was used against a government organization with spearphishing emails.[8]
MITRE attributes to OilRig a campaign using the SampleCheck5000 downloader and Solar backdoor against Israeli organizations.[6]
MITRE attributes to OilRig a campaign using the Mango backdoor against Israeli organizations.[7]
The National Cyber Security Center of Bahrain says some activity of the Iranian actor Lyceum is related to APT34 aka OilRig.[23]
MITRE says OilRig has used the OilBooster downloader since at least 2022, including against organizations in Israel.[9]
MITRE says OilRig has used PowerExchange against government targets in the Middle East.[10]
The UAE Cyber Security Council reported a recent campaign using a new Exchange backdoor and the Windows flaw CVE-2024-30088.[2]
The UAE Cyber Security Council published an advisory naming Earth Simnavaz (APT34, OilRig).[2]
The UAE Cyber Security Council published a second advisory on OilRig with tools and advice.[3]
MITRE ATT&CK last modified its OilRig page, which lists use of CVE-2024-30088 without giving a date.[1]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 21 October 2019 | NCSC UK, with the US NSA | Joint advisoryTurla advisory that says Turla used Iranian groups' control panels, and that others attribute one Middle East victim's panel to APT34 (also known as OilRig/Crambus).[4] |
| 23 October 2019 (last revised) | CISA | AlertAlert on the same advisory names APT 34, known as HELIX KITTEN or OilRig, and warns that activity seeming to come from it may be Turla.[5] |
| 2019 entry in the report | CERT-EU | Threat landscape reportThe 10 Years Edition repeats that Turla compromised APT34 and used its tools and infrastructure.[24] |
| 15 June 2022 | National Cyber Security Center, Bahrain | AdvisoryAdvisory on the Iranian actor Lyceum in the Middle East energy and telecoms sectors says some of its activity is related to APT34 aka OilRig.[23] |
| 14 October 2024 | UAE Cyber Security Council | AdvisoryEarth Simnavaz (APT34, OilRig) campaign against critical infrastructure and energy in the UAE and Gulf, with tools, a vulnerability and advice.[2] |
| 26 December 2024 | UAE Cyber Security Council | AdvisoryOilRig profile with history, tools, techniques and recommendations.[3] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Attachment T1566.001
MITRE says it sends spearphishing emails with malicious attachments, using compromised or spoofed email accounts.[1]
Phishing: Spearphishing via Service T1566.003
MITRE says it has used LinkedIn to send links, and the UAE advisory mentions LinkedIn lures to steal credentials.[1, 3]
Supply Chain Compromise T1195
MITRE says it has used compromised organizations to run supply chain attacks on government entities.[1]
External Remote Services T1133
MITRE says it uses VPN, Citrix or Outlook Web Access to stay in an environment.[1]
Server Software Component: Web Shell T1505.003
MITRE says it has used web shells, often to keep access to a victim network.[1]
Office Application Startup: Outlook Home Page T1137.004
MITRE says it abused the Outlook Home Page feature to stay in a system.[1]
BONDUPDATER PowerShell backdoor
MITRE says it was first seen in November 2017 against a Middle Eastern government organization.[8]
Helminth Backdoor
MITRE describes a backdoor with two variants, one delivered through Excel macros; the UAE advisory calls it an early tool.[11, 3]
QUADAGENT PowerShell backdoor
MITRE lists it as a PowerShell backdoor used by OilRig; the UAE advisory lists a 2018 campaign.[12, 3]
OopsIE Trojan
MITRE says it runs commands and uploads or downloads files on victims.[13]
RGDoor IIS backdoor
MITRE says it was seen on web servers of Middle East government organizations.[14]
Solar Backdoor
MITRE says it was used in the Outer Space campaign to download, run and steal files.[15]
Mango Backdoor
MITRE calls it the successor to Solar, used in the Juicy Mix campaign.[16]
OilBooster Downloader
MITRE says it has been used since at least 2022, including against organizations in Israel.[9]
PowerExchange PowerShell backdoor
MITRE says it has been used since at least 2023 against Middle East government targets.[10]
STEALHOOK Credential theft tool
The UAE advisory says it takes user credentials and sends them out as email attachments.[2]
Mimikatz and LaZagne Credential dumping tools
MITRE says it has used Mimikatz, and credential dumping tools such as LaZagne, to steal logins; the UAE advisory of December 2024 also names both.[1, 3, 25]
ngrok Tunnelling tool
MITRE lists ngrok among remote monitoring tools OilRig has used, and the October 2024 UAE advisory says it is used for tunnels for command traffic.[1, 2, 26]
Also linked in our threat library:
Require multi-factor authentication on VPN, Citrix and webmail, remove remote services nobody needs, and route access through managed gateways.
Counters T1133
Patch Windows promptly, including the kernel flaw CVE-2024-30088 named by the UAE advisory.
Counters T1068
Turn on attack surface reduction rules that protect LSASS and use Credential Guard where hardware allows.
Counters T1003.001
Limit who can change web server folders, and alert when web server processes start command shells.
Counters T1505.003
Apply the Outlook patches MITRE lists and block Office programs from starting child processes.
Counters T1137.004
Spot fake VPN portals, job sites and look-alike domains made to lure your staff, and get them taken down.
See which VPN, Citrix, webmail and Exchange services your company exposes to the internet so you can fix them first.
Be alerted when staff logins appear on criminal marketplaces, before they are used on remote access.
Follow new government advisories that name OilRig, APT34 or Earth Simnavaz, the tools they list (such as STEALHOOK and PowerExchange), and targeting of energy, government and telecoms in the Gulf and Israel.
MITRE ATT&CK keeps one page for both and says they were combined after further reporting raised confidence that the activity overlapped.
MITRE says it is a suspected Iranian group working on behalf of the Iranian government. The UAE advisories name no country, and no source used here names an agency.
MITRE lists financial, government, energy, chemical and telecommunications victims in the Middle East and elsewhere. The UAE Cyber Security Council names energy, critical infrastructure, government and technology providers.
MITRE records phishing emails with malicious attachments or links, fake VPN and job sites, LinkedIn lures, stolen logins on VPN, Citrix or Outlook Web Access, and a Windows kernel flaw for higher rights.
The UAE Cyber Security Council published advisories on 14 October and 26 December 2024, and MITRE updated its page on 31 July 2026. No source used here dates newer operations.
Turn on multi-factor authentication for remote logins, block risky attachments and patch Windows promptly, as the UAE advisories and MITRE mitigations advise.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.