OilRig Targeting Middle East with New Backdoor

A cyber espionage campaign by an Iranian nation-state Advanced Persistent Threat (APT) targeting government organizations in the Middle East through a new strain of malware. OilRig has been targeting government organizations in the Middle East through a new backdoor. OilRig is highly suspected of its association with APT34, Cobalt Gypsy, Europium, and Helix Kitten cyber-espionage groups. The main purpose of this campaign is to gain access to corporate networks and exfiltrate sensitive data. The threat actor distributed phishing emails to the victims through the government’s Exchange Servers from legitimate compromised valid accounts with stolen passwords. The attack begins with a .NET-based dropper responsible for delivering four different files including one main implant called "DevicesSrv.exe" used to exfiltrate the desired data. The .NET backdoor uses the stolen credentials to send electronic missives to actor-controlled email Gmail and Proton Mail addresses. A Dynamic-Link Library (DLL) file is used to harvest domain users and local account credentials.