- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Palo Alto Networks Live Community provides details on a current security threat from a middle eastern hacker group known as OilRig. Read more on how OilRig targets government organizations and the hack methods they could be using to access information. Join the discussion with other security professionals on Live Community.
The OilRig group has been active since at least mid-2016, and continues their attack campaigns throughout the Middle East, targeting both governmental agencies and businesses on an almost routine basis.
In August 2018, Unit 42 observed OilRig targeting a government organization using spear-phishing emails to deliver an updated version of a Trojan known as BONDUPDATER. The BONDUPDATER Trojan contains basic backdoor functionality, allowing threat actors to upload and download files, as well as the ability to execute commands. During the past month, Unit 42 observed several attacks against a Middle Eastern government, leveraging an updated version of the BONDUPDATER malware, which now includes the ability to use TXT records within its DNS tunneling protocol for its C2 communications.
In mid-August, the OilRig threat group sent what appeared to be a highly targeted phishing email to a high-ranking office in a Middle Eastern nation. The spear-phishing email had an attached Microsoft Word document that contained a macro responsible for installing a new variant of BONDUPDATER.
Spear phishing email sent by the OilRig threat group
OilRig is a highly diverse and very resourceful threat actor, employing a litany of methods and tools to compromise victims, but Palo Alto Networks customers are protected from this OilRig attack and BONDUPDATER by:
Find out more about this specific threat on the UNIT 42 blog.
-Kiwi out!
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Subject | Likes |
---|---|
7 Likes | |
2 Likes | |
2 Likes | |
1 Like | |
1 Like |