OilRig

{
  "id": "ATTACK:ics:G0049",
  "title": "OilRig",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0049",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
  "external_id": "G0049",
  "domain": "ics",
  "created": "2017-12-14T16:46:06.044Z",
  "modified": "2026-07-31T20:48:34.886Z",
  "version": "5.0",
  "aliases": [
    "OilRig",
    "COBALT GYPSY",
    "IRN2",
    "APT34",
    "Helix Kitten",
    "Evasive Serpens",
    "Hazel Sandstorm",
    "EUROPIUM",
    "ITG13",
    "Earth Simnavaz",
    "Crambus",
    "TA452"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "IRN2"
    },
    {
      "source_name": "ITG13"
    },
    {
      "source_name": "Hazel Sandstorm"
    },
    {
      "source_name": "EUROPIUM"
    },
    {
      "source_name": "OilRig"
    },
    {
      "source_name": "TA452"
    },
    {
      "source_name": "COBALT GYPSY"
    },
    {
      "source_name": "Crambus"
    },
    {
      "source_name": "Earth Simnavaz"
    },
    {
      "source_name": "Helix Kitten"
    },
    {
      "source_name": "Evasive Serpens"
    },
    {
      "source_name": "Check Point APT34 April 2021",
      "url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
    },
    {
      "source_name": "ClearSky OilRig Jan 2017",
      "url": "http://www.clearskysec.com/oilrig/"
    },
    {
      "source_name": "Trend Micro Earth Simnavaz October 2024",
      "url": "https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"
    },
    {
      "source_name": "Palo Alto OilRig May 2016",
      "url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
    },
    {
      "source_name": "Palo Alto OilRig April 2017",
      "url": "http://researchcenter.paloaltonetworks.com/2017/04/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/"
    },
    {
      "source_name": "Palo Alto OilRig Oct 2016",
      "url": "http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"
    },
    {
      "source_name": "IBM ZeroCleare Wiper December 2019",
      "url": "https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"
    },
    {
      "source_name": "Unit 42 QUADAGENT July 2018",
      "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
    },
    {
      "source_name": "Crowdstrike Helix Kitten Nov 2018",
      "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Proofpoint Iranian Aligned Attacks JAN 2020",
      "url": "https://www.proofpoint.com/us/corporate-blog/post/iranian-state-sponsored-and-aligned-attacks-what-you-need-know-and-steps-protect"
    },
    {
      "source_name": "FireEye APT34 Dec 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
    },
    {
      "source_name": "Secureworks COBALT GYPSY Threat Profile",
      "url": "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy"
    },
    {
      "source_name": "Symantec Crambus OCT 2023",
      "url": "https://www.security.com/threat-intelligence/crambus-middle-east-government"
    },
    {
      "source_name": "APT34"
    },
    {
      "source_name": "Unit 42 Playbook Dec 2017",
      "url": "https://pan-unit42.github.io/playbook_viewer/"
    },
    {
      "source_name": "Unit42 OilRig Playbook 2023",
      "url": "https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"
    }
  ]
}