FilthyFeline

Summary

ESET's name for an OilRig subgroup that it links to Iran's Ministry of Intelligence and Security; it shares tradecraft with Lyceum and MuddyWater. After going quiet at the start of the US/Israel war on Iran (late February–early March 2026), it resumed operations between April and September 2026, mostly against Israeli organisations across sectors and, in smaller numbers, US companies. It took over targeting of an Uzbek cellular data provider that BladedFeline had compromised in 2023, and used the domain micsinfy[.]eu against victims in Europe from 19 March to 9 July 2026. For its European operations it used the domain micsinfy[.]eu with a Let's Encrypt certificate (T1588.004). Only ESET reports it publicly so far, so the record is single-vendor.

Attribution

ESET: an OilRig subgroup linked to MOIS; no government attribution

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• ESET Research (Research, 2026-10-28)
  OilRig subgroup linked to Iran's MOIS, sharing TTPs with Lyceum and MuddyWater

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 1

Infrastructure patterns

• micsinfy[.]eu with a Let's Encrypt certificate against European victims, Mar–Jul 2026 (ESET, 2026)

Reporting and advisories 2

• ESET Research
  ESET APT Activity Report Q2–Q3 2026 (Oct 2026)
• ESET Research
  ESET APT Activity Report Q2 2026–Q3 2026 — summary (Oct 2026)