Cybersecurity researchers at ESET have analyzed two cyberespionage campaigns conducted by the OilRig APT group, targeting Israeli organizations. The campaigns, named Outer Space (2021) and Juicy Mix (2022), used similar tactics, with OilRig compromising legitimate websites to use as C2 servers.
Diving into details
OilRig's tactics included spear-phishing emails, VBS droppers, and post-compromise tools for data exfiltration, highlighting their continued focus on the Middle East.
- The Outer Space campaign utilized the Solar backdoor and the SC5k downloader, while the Juicy Mix campaign featured the Mango backdoor and additional browser-data dumpers and credential stealers.
- The Mango first-stage backdoor is an upgraded version of Solar, also coded in C#/.NET. Mango’s capabilities include data exfiltration, use of native APIs, and code for detection evasion.
- Besides Mango, the researchers found two previously undocumented browser data dumpers. These were used to pilfer cookies, credentials, and browser history from Chrome and Edge browsers. Furthermore, the researchers attributed a Windows Credential Manager to the threat group.
Latest OilRig campaigns
- In May, the group targeted a government official at Jordan's foreign ministry using a malicious email and Excel document.
- The attack utilized a new hacking tool called Saitama, which abuses the DNS protocol for stealthy communication and shows signs of advanced knowledge about the victim's internal infrastructure.
- In February, OilRig developed a new backdoor to bypass security measures and target government organizations in the Middle East.
- The attack began with a .NET-based dropper, responsible for distributing four distinct files. These files were embedded within the main dropper, known as REDCAP, using a Base64 buffer.
The bottom line
Active since at least 2014, OilRig continues to be a menace, especially to Middle Eastern entities. It has been innovating and creating new implants with backdoor-like functionalities while attempting to find new ways to execute commands remotely. To mitigate these threats, organizations should prioritize email security measures and employee training to combat spear-phishing attacks, while also maintaining a proactive approach to keeping their software and systems updated with the latest security patches.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/22d0_shutterstock_659861572.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/341c_shutterstock_1957755748.jpeg)
