G0049 OilRig
EnterpriseICSalso known asOilRig · COBALT GYPSY · IRN2 · APT34 · Helix Kitten · Evasive Serpens · Hazel Sandstorm · EUROPIUM · ITG13 · Earth Simnavaz · Crambus · TA452
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.
canonical actor
The group this is attributed to.
techniques used (82)
ATT&CK techniques this enables or maps to.
software used (30)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
Detected by (Sigma) (5)
Sigma detection rules related to this.
source
Where this definition is published.