APT34 (Earth Simnavaz) Conducts Advanced Cyberattacks Against Middle East

Earth Simnavaz (also known as APT34 and OilRig) is a cyber espionage group actively targeting leading entities and infrastructure in the Middle East, particularly organizations involved in oil, gas, and other infrastructure sectors. The group deploys sophisticated backdoors that leverage Microsoft Exchange servers for credential theft, exploits CVE-2024-30088 for privilege escalation, abuses password filter policies to harvest plaintext credentials, and uses customized .NET tools, PowerShell scripts, IIS-based malware, and the ngrok remote management tool to maintain persistence, blend malicious activity with normal network traffic, exfiltrate sensitive information, and establish a persistent foothold within compromised organizations.