IranAssessedMOISEspionageActive 2014 – 2025OilRig
Also known asHelix Kitten · COBALT GYPSY · Crambus · EUROPIUM · Twisted Kitten · ITG13 · Chrysene · Evasive Serpens · IRN2 · ATK40 · Hazel Sandstorm · TA452 · Yellow Maero · Earth Simnavaz
Summary
MOIS-linked Iranian APT (Microsoft: Hazel Sandstorm; FireEye/Mandiant: APT34; CrowdStrike: Helix Kitten). Long-standing espionage operator focused on the Middle East; FireEye lists financial, government, energy, chemical and telecommunications targets. From September 2024 it targeted Iraqi government entities with the Veaty and Spearal backdoors and, in parallel, Gulf/UAE targets with CVE-2024-30088 (Windows kernel privilege escalation) and the STEALHOOK exfiltration tool (Trend Micro, Oct 2024; Trellix, Mar 2026). Its latest confirmed public activity is from 2025: a joint sub-campaign by its Lyceum subgroup with MuddyWater against an Israeli manufacturing organisation (ESET; tracked on the Lyceum record) and attacks on US transportation and manufacturing firms (Nozomi). Related but separately tracked MOIS clusters include UNC1860/ShroudedSnooper/Scarred Manticore, which collaborates with APT34 as an initial-access provider. Tradecraft includes DNS-based C2 and web shells (MITRE), Exchange Web Services and Office 365 as C2 channels (ESET), and Exchange-based credential exfiltration with a password-filter DLL that captures clear-text passwords (Trend Micro).
Attribution
Ministry of Intelligence and Security
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- Microsoft (Research, 2022-09-08)
EUROPIUM (OilRig) has been publicly linked to Iran's Ministry of Intelligence and Security - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Works on behalf of the Iranian government - Mandiant (Research, 2024-09-19)
Refers to APT34 as MOIS-affiliated
Campaigns 7
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| US transportation & manufacturing attacks (Israel–Iran war period) | 2025-05 – 2025-06 | USA | Transportation, Manufacturing | Nozomi Networks Labs (2025-07-08) |
| Iraqi government targeting (Veaty / Spearal) | 2024-09 – 2024 | Iraq | Government | Trellix (2026-03-05) |
| UAE Government Targeting via CVE-2024-30088 | 2024 | UAE, Gulf | Government | Trellix (2026-03-05); Trend Micro (2024-10-11) |
| Juicy Mix — Mango backdoor via compromised Israeli websites | 2022 | Israel | Human Resources, Multiple | ESET (2023-09-21); MITRE C0042/C0044 |
| Outer Space — Solar backdoor and SampleCheck5000 via compromised Israeli websites | 2021 | Israel | Human Resources, Multiple | ESET (2023-09-21); MITRE C0042/C0044 |
| BladedFeline — KRG, Iraqi government and Uzbek telecom espionageASSESSED | 2017 – 2025 | Iraq, Kurdistan Region (Iraq), Uzbekistan | Government, Diplomacy, Telecommunications | ESET (2025-06-05) |
| Middle East espionage — POWRUNER / BONDUPDATER (CVE-2017-11882) | 2014 – 2017-11 | Middle East | Financial, Government, Energy, Chemical, Telecommunications | FireEye (2017-12-07) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 7
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution2 | T1059.001PowerShellT1047Windows Management Instrumentation |
| Persistence1 | T1505.003Web Shell |
| Credential Access1 | T1003.001LSASS Memory |
| Command and Control2 | T1071.004DNST1102.002Bidirectional Communication |
Malware and tools 13
| Name | Description | Platform |
|---|---|---|
| RDAT | Exchange-based Backdoor | Windows |
| BONDUPDATER | DNS Tunnelling Backdoor | Windows |
| SideTwist | Backdoor | Windows |
| Saitama | .NET backdoor with DNS-based C2 | Windows |
| Menorah | Backdoor | Windows |
| Marlin | Backdoor | Windows |
| STEALHOOK | Credential exfiltration via Exchange mail | Windows |
| Veaty | Backdoor (email-based C2) | Windows |
| Spearal | Backdoor (DNS-tunnelling C2) | Windows |
| Solar | C#/.NET backdoor (Outer Space, 2021) | Windows |
| Mango | C#/.NET backdoor, successor of Solar (Juicy Mix, 2022) | Windows |
| SampleCheck5000 | Downloader using Exchange Web Services API for C2 | Windows |
| Helminth | Backdoor (legacy, VBScript/PowerShell and executable variants) | Windows |
Exploited vulnerabilities 3
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2017-11774 | 7.8 | Microsoft Outlook — security feature bypass (Home Page) (KEV 2021-11-03) |
| CVE-2017-11882 | 7.8 | Microsoft Office Equation Editor — memory corruption RCE (KEV 2021-11-03) |
| CVE-2024-30088 | 7 | Microsoft Windows Kernel — TOCTOU race privilege escalation (KEV 2024-10-15) |
Highest CVSS first.
Infrastructure patterns
- Compromised legitimate websites used as C2 and to stage tools (ESET, 2023; MITRE ATT&CK, 2026)
- DNS as its primary C2 channel; Exchange and FTP for exfiltration (MITRE ATT&CK, 2026)
Reporting and advisories 9
- FireEye
Middle East espionage — POWRUNER / BONDUPDATER (CVE-2017-11882) - Trellix
UAE Government Targeting via CVE-2024-30088 - ESET
BladedFeline — KRG, Iraqi government and Uzbek telecom espionage - Nozomi Networks Labs
US transportation & manufacturing attacks (Israel–Iran war period) - ESET
Outer Space — Solar backdoor and SampleCheck5000 via compromised Israeli websites - MITRE ATT&CK
OilRig (G0049) group profile - Malwarebytes
APT34 targets Jordan Government using new Saitama backdoor (May 2022) - Trend Micro
APT34 Deploys Phishing Attack With New Malware — Menorah (Sep 2023) - Trend Micro
Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East (Oct 2024)