OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.1234567
- FireEye APT34 Dec 2017
- Palo Alto OilRig April 2017
- ClearSky OilRig Jan 2017
- Palo Alto OilRig May 2016
- Palo Alto OilRig Oct 2016
- Unit42 OilRig Playbook 2023
- Unit 42 QUADAGENT July 2018
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | OilRig | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | COBALT GYPSY | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | IRN2 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | APT34 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Helix Kitten | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Evasive Serpens | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Hazel Sandstorm | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | EUROPIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | ITG13 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Earth Simnavaz | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Crambus | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TA452 | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1008 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1137.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1025 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1201 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1115 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.004 | LSA Secrets | — |
| T1003.005 | Cached Domain Credentials | — |
| T1005 | Data from Local System | — |
| T1007 | System Service Discovery | — |
| T1008 | Fallback Channels | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1025 | Data from Removable Media | — |
| T1027.005 | Indicator Removal from Tools | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1033 | System Owner/User Discovery | — |
| T1036 | Masquerading | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1069.001 | Local Groups | — |
| T1069.002 | Domain Groups | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1071.004 | DNS | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1082 | System Information Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1115 | Clipboard Data | — |
| T1119 | Automated Collection | — |
| T1120 | Peripheral Device Discovery | — |
| T1133 | External Remote Services | — |
| T1137.004 | Outlook Home Page | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1195 | Supply Chain Compromise | — |
| T1201 | Password Policy Discovery | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.001 | Compiled HTML File | — |
| T1219 | Remote Access Tools | — |
| T1497.001 | System Checks | — |
| T1505.003 | Web Shell | — |
| T1543.003 | Windows Service | — |
| T1552.001 | Credentials In Files | — |
| T1553.002 | Code Signing | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1555.004 | Windows Credential Manager | — |
| T1556.002 | Password Filter DLL | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1566.003 | Spearphishing via Service | — |
| T1572 | Protocol Tunneling | — |
| T1573.002 | Asymmetric Cryptography | — |
| T1583.001 | Domains | — |
| T1586.002 | Email Accounts | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1588.003 | Code Signing Certificates | — |
| T1608.001 | Upload Malware | — |
| T1686.003 | Windows Host Firewall | — |
Aliases
APT34 · COBALT GYPSY · Crambus · Earth Simnavaz · EUROPIUM · Evasive Serpens · Hazel Sandstorm · Helix Kitten · IRN2 · ITG13 · OilRig · TA452
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.