{
  "id": "oilrig",
  "name": "OilRig",
  "aliases": [
    "COBALT GYPSY",
    "IRN2",
    "APT34",
    "Helix Kitten",
    "Evasive Serpens",
    "Hazel Sandstorm",
    "EUROPIUM",
    "ITG13",
    "Earth Simnavaz",
    "Crambus",
    "TA452"
  ],
  "domain": "cyber",
  "country": "IRN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "IRN"
  ],
  "summary": "OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Suspected Iranian group",
      "src": [
        "mitre-g0049"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2014,
      "src": [
        "mitre-g0049"
      ],
      "conf": "medium",
      "note": "At least 2014"
    },
    {
      "k": "attack_id",
      "v": "G0049",
      "src": [
        "mitre-g0049"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014.",
      "src": [
        "mitre-g0049"
      ],
      "conf": "medium"
    },
    {
      "k": "campaigns",
      "v": "Outer Space (C0042, 2021–2021); Juicy Mix (C0044, 2022–2022)",
      "src": [
        "mitre-g0049"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 76,
      "src": [
        "mitre-g0049"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BONDUPDATER, certutil, ftp, Helminth, ipconfig, ISMInjector, LaZagne, Mango, Mimikatz, Net, netstat, ngrok, ODAgent, OilBooster, OilCheck, OopsIE, PowerExchange, POWRUNER, PsExec, QUADAGENT and 10 more",
      "src": [
        "mitre-g0049"
      ],
      "conf": "high",
      "note": "30 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0049)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/oilrig.html",
  "sources": {
    "mitre-g0049": {
      "title": "OilRig, Group G0049",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0049/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}