ATK40

ATK40 (aka: OilRig, APT34) is an Iranian cyberespionage threat actor active since at least 2014 primarily operating in the Middle East region. The group targets as a priority the financial institutions of the Sunni Gulf States, but also the United States and Israel, traditional geopolitical opponents of the Republic of the Mullahs. During the OilRig campaign in 2016 against financial institutions in Saudi Arabia, the group demonstrate capabilities to adapt its procedures and to use multiple delivery methods, particularly through well-crafted spear-phishing messages relevant to the interests of targeted personnel and custom PowerShell implants like the Helminth backdoor. He relies heavily on the human factor for the initial access. After the firsts report by FireEye and PaloAlto, the group has been actively updating his tools and expands his scope of targets (Qatar, Turkey, Israel and United States). The group continue to use communication though DNS Tunnelling to the command and control server to stay under the radar. In early 2017, the group demonstrate the ability to use digitally signed malware spread through fake websites (University of Oxford conference sign-up page and a job application website). PaloAlto observed an overlap in C&C IP address used by OilRig and used by Chafer for his Remexi backdoor C&C, suggesting that these groups are one entity or that they share resources. Furthermore, the similarity between the malware ISMAgent used by OilRig and ISMDoor used by GreenBug suggest a link between these groups.

This actor shows high capabilities of adaptation, creating new custom delivery documents and backdoor and using multiple TTP to re-infect previous targets who took actions to counter their known TTP. We did not observe this actor using a zero-day exploit, but it quickly used the CVE-2017-0199 and CVE-2017-11882 which are widely used to improve the quality of his lure documents.

DragoS considers that ATK40(OilRig) and ATK59(Greenbug) are the same threat group and carried out initial preparations and network intrusion in advance of the Shamoon event. This group test regularly its samples on anti-virus testers like VirusTotal to determine on what content of their malwares are detected. This technique helped to build nearly undetected samples but allowed researchers to follow the modifications. In April 2019, multiple OilRig tools are leaked on a Github repository, including BONDUPDATER, the TwoFace WebShell and webmask, a tool linked to DNSpionage. This leak is followed in June 2019 by another about the tool Jason.

OilRig infrastructure is continuously growing but overlaps with previously used infrastructure. The group reuse his tools, use the same attack protocols and has a consistent victimology which makes it easy to track down.