D
CyberIran

OilRig

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452

CyberIRN
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeSuspected state-linked cyber threat group
Alternative designationsCOBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452
ProliferationOrigin country only
Active since2014At least 2014Med[1]
MITRE ATT&CK IDG0049High[1]
Capabilities
ATT&CK techniques used76ATT&CK v20.1High[1]
Malware and toolsBONDUPDATER, certutil, ftp, Helminth, ipconfig, ISMInjector, LaZagne, Mango, Mimikatz, Net, netstat, ngrok, ODAgent, OilBooster, OilCheck, OopsIE, PowerExchange, POWRUNER, PsExec, QUADAGENT and 10 more30 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorSuspected Iranian groupMed[1]
TargetsOilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014.Med[1]
Notable activityOuter Space (C0042, 2021–2021); Juicy Mix (C0044, 2022–2022)Med[1]
Notes
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Iran
Sources
  1. OilRig, Group G0049, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0049)