SYMBOLCOMMON_NAMEaka. SYNONYMS

CHRYSENE  (Back to overview)

aka: APT34, Cobalt Gypsy, EUROPIUM, Greenbug, Hazel Sandstorm, OilRig

Adversaries abusing ICS (based on Dragos Inc adversary list). This threat actor targets organizations involved in oil, gas, and electricity production, primarily in the Gulf region, for espionage purposes. According to one cybersecurity company, the threat actor “compromises a target machine and passes it off to another threat actor for further exploitation.”

Associated Families
ps1.oilrig ps1.powruner ps1.quadagent win.google_drive_rat win.jason win.karkoff win.mango win.neuron win.oopsie win.redcap win.saitama win.sidetwist win.solar win.valuevault win.pupy asp.twoface ps1.bondupdater win.alma_communicator win.helminth win.ismagent win.ismdoor win.longwatch win.nautilus win.pickpocket win.rdat win.stealhook win.tonedeaf win.zerocleare apk.spynote
References
2024-10-11 ⋅ Trend Micro ⋅ Ahmed Kamal, Bahaa Yamany, Mohamed Fahmy, Nick Dai
Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East
STEALHOOK OilRig
2024-10-11 ⋅ Trend Micro ⋅ Ahmed Kamal, Bahaa Yamany, Mohamed Fahmy, Nick Dai
Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against UAE and Gulf Regions
STEALHOOK
2024-10-08 ⋅ Hunt.io ⋅ Hunt.io
Inside a Cybercriminal’s Server: DDoS Tools, Spyware APKs, and Phishing Pages
SpyNote
2024-08-14 ⋅ cyble ⋅ Cyble
Cryptocurrency Lures and Pupy RAT: Analysing the UTG-Q-010 Campaign
pupy UTG-Q-010
2024-06-26 ⋅ Group-IB ⋅ Group-IB
Craxs Rat, the master tool behind fake app scams and banking fraud
CraxsRAT SpyMax SpyNote
2024-06-20 ⋅ Hunt.io ⋅ Michael R
Caught in the Act: Uncovering SpyNote in Unexpected Places
SpyNote
2024-02-19 ⋅ Fortinet ⋅ Axelle Apvrille
Android/SpyNote bypasses Restricted Settings + breaks many RE tools
SpyNote
2024-02-15 ⋅ Fortinet ⋅ Axelle Apvrille
Android/SpyNote Moves to Crypto Currencies
SpyNote
2023-09-21 ⋅ ESET Research ⋅ Zuzana Hromcová
OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes
Mango Solar
2023-08-30 ⋅ NSFOCUS ⋅ NSFOCUS
APT34 Unleashes New Wave of Phishing Attack with Variant of SideTwist Trojan
SideTwist
2023-07-31 ⋅ Cleafy ⋅ Francesco Iubatti
SpyNote continues to attack financial institutions
SpyNote
2023-05-10 ⋅ K7 Security ⋅ Baran S
spynote
SpyNote
2023-02-02 ⋅ Trend Micro ⋅ Mahmoud Zohdy, Mohamed Fahmy, Sherif Magdy
New APT34 Malware Targets The Middle East
Karkoff RedCap Saitama Backdoor
2023-01-05 ⋅ Bleeping Computer ⋅ Bill Toulas
SpyNote Android malware infections surge after source code leak
SpyNote
2023-01-05 ⋅ ThreatFabric ⋅ ThreatFabric
SpyNote: Spyware with RAT capabilities targeting Financial Institutions
SpyMax SpyNote
2023-01-04 ⋅ K7 Security ⋅ Saikumaravel
Pupy RAT hiding under WerFault’s cover
pupy
2022-12-06 ⋅ ⋅ 360 Threat Intelligence Center ⋅ 360 Beacon Lab
Analysis of suspected APT-C-56 (Transparent Tribe) attacks against terrorism
AhMyth Meterpreter SpyNote AsyncRAT
2022-09-26 ⋅ CrowdStrike ⋅ Ioan Iacob, Iulian Madalin Ionita
The Anatomy of Wiper Malware, Part 3: Input/Output Controls
CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper Meteor Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare
2022-09-08 ⋅ Microsoft ⋅ Microsoft Security Threat Intelligence
Microsoft investigates Iranian attacks against the Albanian government
ZeroCleare
2022-08-17 ⋅ ⋅ 360 ⋅ 360 Threat Intelligence Center
Kasablanka organizes attacks against political groups and non-profit organizations in the Middle East
SpyNote Loda Nanocore RAT NjRAT
2022-08-12 ⋅ CrowdStrike ⋅ Ioan Iacob, Iulian Madalin Ionita
The Anatomy of Wiper Malware, Part 1: Common Techniques
Apostle CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper IsraBye KillDisk Meteor Olympic Destroyer Ordinypt Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare
2022-08-10 ⋅ K7 Security ⋅ Baran S
spynote
SpyNote
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Evasive Serpens
TwoFace ISMAgent ISMDoor OopsIE RDAT OilRig
2022-06-24 ⋅ XJunior ⋅ Mohamed Ashraf
APT34 - Saitama Agent
Saitama Backdoor
2022-06-20 ⋅ ⋅ Infinitum IT ⋅ infinitum IT
Charming Kitten (APT35)
LaZagne DownPaper MimiKatz pupy
2022-06-15 ⋅ Volexity ⋅ Steven Adair, Thomas Lancaster, Volexity Threat Research
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
pupy Sliver DriftingCloud
2022-06-13 ⋅ SANS ISC ⋅ Renato Marinho
Translating Saitama's DNS tunneling messages
Saitama Backdoor
2022-05-23 ⋅ Trend Micro ⋅ Daniel Lunghi, Jaromír Hořejší
Operation Earth Berberoka
reptile oRAT Ghost RAT PlugX pupy Earth Berberoka
2022-05-11 ⋅ Fortinet ⋅ Fred Gutierrez
Please Confirm You Received Our APT
Saitama Backdoor
2022-05-10 ⋅ Malwarebytes Labs ⋅ Threat Intelligence Team
APT34 targets Jordan Government using new Saitama backdoor
Saitama Backdoor
2022-04-28 ⋅ Fortinet ⋅ Gergely Revay
An Overview of the Increasing Wiper Malware Threat
AcidRain CaddyWiper DistTrack DoubleZero EternalPetya HermeticWiper IsaacWiper Olympic Destroyer Ordinypt WhisperGate ZeroCleare
2022-04-27 ⋅ Trendmicro ⋅ Trendmicro
IOCs for Earth Berberoka - Linux
Rekoobe pupy Earth Berberoka
2022-03-30 ⋅ Recorded Future ⋅ Insikt Group
Social Engineering Remains Key Tradecraft for Iranian APTs
Liderc pupy
2021-12-14 ⋅ Recorded Future ⋅ Insikt Group®
Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE
TwoFace
2021-09-21 ⋅ civilsphereproject ⋅ civilsphereproject
Capturing and Detecting AndroidTester Remote Access Trojan with the Emergency VPN
SpyNote
2021-06-16 ⋅ ⋅ Venustech ⋅ ADLab
APT34 organization latest in-depth analysis report on attack activities
Karkoff
2021-04-21 ⋅ Facebook ⋅ David Agranovich, Mike Dvilyanski
Taking Action Against Hackers in Palestine
SpyNote Houdini NjRAT
2021-04-08 ⋅ Checkpoint ⋅ Check Point Research
Iran’s APT34 Returns with an Updated Arsenal
DNSpionage SideTwist TONEDEAF
2021-02-28 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team
2021-02-18 ⋅ PTSecurity ⋅ PTSecurity
https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/
Poet RAT Gravity RAT Ketrican Okrum OopsIE Remcos RogueRobinNET RokRAT SmokeLoader
2020-12-10 ⋅ Intel 471 ⋅ Intel 471
No pandas, just people: The current state of China’s cybercrime underground
Anubis SpyNote AsyncRAT Cobalt Strike Ghost RAT NjRAT
2020-12-01 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
Blade Eagle Group - Targeted attack group activities circling the Middle East and West Asia's cyberspace revealed
SpyNote BladeHawk
2020-11-27 ⋅ PTSecurity ⋅ Alexey Vishnyakov, Denis Goydenko
Investigation with a twist: an accidental APT attack and averted data destruction
TwoFace CHINACHOPPER HyperBro MegaCortex MimiKatz
2020-09-25 ⋅ Emanuele De Lucia
APT vs Internet Service Providers
TwoFace RGDoor
2020-09-15 ⋅ CrowdStrike ⋅ CrowdStrike Overwatch Team
Nowhere to Hide - 2020 Threat Hunting Report
NedDnLoader RDAT TRACER KITTEN
2020-07-22 ⋅ Palo Alto Networks Unit 42 ⋅ Robert Falcone
OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory
RDAT OilRig
2020-07-22 ⋅ Threatpost ⋅ Tara Seals
OilRig APT Drills into Malware Innovation with Unique Backdoor
OilRig
2020-07-15 ⋅ Relativity ⋅ Bartlomiej Czyż
An in-depth analysis of SpyNote remote access trojan
SpyNote
2020-07-13 ⋅ FireEye ⋅ Aaron Stephens, Andrew Thompson
SCANdalous! (External Detection Using Network Scan Data and Automation)
POWERTON QUADAGENT PoshC2
2020-06-18 ⋅ Australian Cyber Security Centre ⋅ Australian Cyber Security Centre (ACSC)
Advisory 2020-008: Copy-Paste Compromises –tactics, techniques and procedures used to target multiple Australian networks
TwoFace Cobalt Strike Empire Downloader
2020-05-19 ⋅ Symantec ⋅ Critical Attack Discovery and Intelligence Team
Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia
ISMAgent ISMDoor
2020-03-31 ⋅ Volexity ⋅ Volexity Threat Research
Storm Cloud Unleashed: Tibetan Focus of Highly Targeted Fake Flash Campaign
SpyNote Stitch Godlike12 Storm Cloud
2020-03-12 ⋅ Recorded Future ⋅ Insikt Group
Swallowing the Snake’s Tail: Tracking Turla Infrastructure
TwoFace Mosquito
2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle
2020-03-02 ⋅ Yoroi ⋅ ZLAB-Yoroi
Karkoff 2020: a new APT34 espionage operation involves Lebanon Government
Karkoff
2020-03-02 ⋅ Telsy ⋅ Telsy
APT34 (aka OilRig, aka Helix Kitten) attacks Lebanon government entities with MailDropper implants
Karkoff
2020-02-13 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2020-01-30 ⋅ Intezer ⋅ Michael Kajiloti, Paul Litvak
New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset
TONEDEAF VALUEVAULT
2020-01-23 ⋅ Recorded Future ⋅ Insikt Group
European Energy Sector Organization Targeted by PupyRAT Malware in Late 2019
pupy pupy pupy
2020-01-17 ⋅ FireEye ⋅ FireEye
State of the Hack: Spotlight Iran - from Cain & Abel to full SANDSPY
QUADAGENT Fox Kitten
2020-01-01 ⋅ FireEye ⋅ Mandiant, Mitchell Clarke, Tom Hall
Mandiant IR Grab Bag of Attacker Activity
TwoFace CHINACHOPPER HyperBro HyperSSL
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
COBALT EDGEWATER
DNSpionage Karkoff DNSpionage
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
COBALT GYPSY
TwoFace MacDownloader BONDUPDATER pupy Helminth jason RGDoor TinyZbot OilRig
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
IRON HUNTER
Agent.BTZ Cobra Carbon System LightNeuron Mosquito Nautilus Neuron Skipper Uroburos Turla
2019-12-09 ⋅ IBM Security ⋅ IBM IRIS
New Destructive Wiper “ZeroCleare” Targets Energy Sector in the Middle East
ZeroCleare
2019-11-20 ⋅ ClearSky ⋅ ClearSky Cyber Security
MuddyWater Uses New Attack Methods in a Recent Attack Wave
QUADAGENT RogueRobin
2019-11-19 ⋅ FireEye ⋅ Kelli Vanderlee, Nalani Fraser
Achievement Unlocked: Chinese Cyber Espionage Evolves to Support Higher Level Missions
MESSAGETAP TSCookie ACEHASH CHINACHOPPER Cobalt Strike Derusbi Empire Downloader Ghost RAT HIGHNOON HTran MimiKatz NetWire RC poisonplug Poison Ivy pupy Quasar RAT ZXShell
2019-11-09 ⋅ NSFOCUS ⋅ Mina Hao
APT34 Event Analysis Report
BONDUPDATER DNSpionage
2019-10-21 ⋅ NCSC UK ⋅ NCSC UK
Advisory: Turla group exploits Iranian APT to expand coverage of victims
Nautilus Neuron
2019-09-18 ⋅ IronNet ⋅ Jonathan Lepore
Chirp of the PoisonFrog
BONDUPDATER
2019-08-22 ⋅ Cyware ⋅ Cyware
APT34: The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations
TwoFace BONDUPDATER POWRUNER QUADAGENT Helminth ISMAgent Karkoff LONGWATCH OopsIE PICKPOCKET RGDoor VALUEVAULT
2019-08-22 ⋅ Github (n1nj4sec) ⋅ n1nj4sec
Pupy RAT
pupy pupy pupy
2019-07-18 ⋅ FireEye ⋅ Jessica Rocchio, Matt Bromiley, Nick Schroeder, Noah Klapprodt
Hard Pass: Declining APT34’s Invite to Join Their Professional Network
LONGWATCH PICKPOCKET TONEDEAF VALUEVAULT
2019-07-08 ⋅ SANS ⋅ Josh M. Bryant, Robert Falcone
Hunting Webshells: Tracking TwoFace
TwoFace
2019-06-06 ⋅ Marco Ramilli
APT34: Jason project
jason
2019-06-03 ⋅ Twitter (@P3pperP0tts) ⋅ Pepper Potts
Tweet on APT34
jason
2019-05-02 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
APT34: Glimpse project
BONDUPDATER
2019-04-30 ⋅ Palo Alto Networks Unit 42 ⋅ Bryan Lee, Robert Falcone
Behind the Scenes with OilRig
BONDUPDATER
2019-04-30 ⋅ ClearSky ⋅ ClearSky Cyber Security
Raw Threat Intelligence 2019-04-30: Oilrig data dump link analysis
SpyNote OopsIE
2019-04-23 ⋅ Talos ⋅ Paul Rascagnères, Warren Mercer
DNSpionage brings out the Karkoff
DNSpionage Karkoff DNSpionage
2019-04-19 ⋅ Medium ⋅ x0rz
Hacking (Back) and Influence Operations
BONDUPDATER
2019-04-17 ⋅ Malware Reversing Blog ⋅ F-Secure Global
The Dukes: 7 Years Of Russian Cyber-Espionage
TwoFace BONDUPDATER DNSpionage
2019-04-16 ⋅ Robert Falcone
DNS Tunneling in the Wild: Overview of OilRig’s DNS Tunneling
BONDUPDATER QUADAGENT Alma Communicator Helminth ISMAgent
2019-03-27 ⋅ Symantec ⋅ Security Response Attack Investigation Team
Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
DarkComet Nanocore RAT pupy Quasar RAT Remcos TURNEDUP APT33
2019-03-27 ⋅ Symantec ⋅ Critical Attack Discovery and Intelligence Team
Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
DarkComet MimiKatz Nanocore RAT NetWire RC pupy Quasar RAT Remcos StoneDrill TURNEDUP APT33
2019-02-13 ⋅ Youtube (SANS Digital Forensics & Incident Response) ⋅ Josh Bryant, Robert Falcone
Hunting Webshells: Tracking TwoFace - SANS Threat Hunting Summit 2018
TwoFace
2019-01-01 ⋅ Dragos ⋅ Dragos
Adversary Reports
ALLANITE APT33 CHRYSENE ENERGETIC BEAR Lazarus Group Sandworm
2019-01-01 ⋅ Council on Foreign Relations ⋅ Cyber Operations Tracker
Chrysene
CHRYSENE
2018-12-21 ⋅ FireEye ⋅ Alex Orleans, Andrew Thompson, Geoff Ackerman, Nick Carr, Rick Cole
OVERRULED: Containing a Potentially Destructive Adversary
POWERTON PoshC2 pupy
2018-12-17 ⋅ Twitter (@MJDutch) ⋅ Justin
Tweet on APT39
OilRig
2018-09-14 ⋅ NetScout ⋅ ASERT Team
Tunneling Under the Sands
BONDUPDATER
2018-09-12 ⋅ Palo Alto Networks Unit 42 ⋅ Kyle Wilhoit, Robert Falcone
OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government
BONDUPDATER
2018-07-07 ⋅ Youtube (SteelCon) ⋅ Dan Caban, Muks Hirani
You’ve Got Mail!
TwoFace
2018-04-20 ⋅ Booz Allen Hamilton ⋅ Jay Novak, Matthew Pennington
Researchers Discover New variants of APT34 Malware
BONDUPDATER POWRUNER
2018-03-25 ⋅ Vitali Kremez Blog ⋅ Vitali Kremez
Let's Learn: Internals of Iranian-Based Threat Group "Chafer" Malware: Autoit and PowerShell Persistence
OilRig
2018-03-01 ⋅ Dragos ⋅ Dragos
INDUSTRIAL CONTROL SYSTEM THREATS
APT33 CHRYSENE ENERGETIC BEAR Lazarus Group Sandworm
2018-03-01 ⋅ Nyotron ⋅ NYOTRON ATTACK RESPONSE CENTER
OilRig is Back with Next-Generation Tools and Techniques
GoogleDrive RAT
2018-02-23 ⋅ Palo Alto Networks Unit 42 ⋅ Bryan Lee, Robert Falcone
OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan
OopsIE
2018-01-17 ⋅ NCSC UK ⋅ NCSC UK
Turla group malware
Nautilus Neuron
2017-12-11 ⋅ Palo Alto Networks Unit 42 ⋅ Robert Falcone
OilRig Performs Tests on the TwoFace Webshell
TwoFace
2017-11-08 ⋅ Palo Alto Networks Unit 42 ⋅ Robert Falcone
OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan
Alma Communicator
2017-10-24 ⋅ ClearSky ⋅ ClearSky Research Team
Iranian Threat Agent Greenbug Impersonates Israeli High-Tech and Cyber Security Companies
ISMDoor
2017-08-28 ⋅ ClearSky ⋅ ClearSky Research Team
Recent ISMAgent Samples and Infrastructure by Iranian Threat Group GreenBug
ISMAgent
2017-07-31 ⋅ Palo Alto Networks Unit 42 ⋅ Bryan Lee, Robert Falcone
TwoFace Webshell: Persistent Access Point for Lateral Movement
TwoFace OilRig
2017-04-27 ⋅ Morphisec ⋅ Michael Gorelik
Iranian Fileless Attack Infiltrates Israeli Organizations
Helminth OilRig
2017-02-16 ⋅ SecurityAffairs ⋅ Pierluigi Paganini
Iranian hackers behind the Magic Hound campaign linked to Shamoon
pupy APT35
2017-02-15 ⋅ Secureworks ⋅ SecureWorks' Counter Threat Unit Research Team
Iranian PupyRAT Bites Middle Eastern Organizations
pupy Cleaver
2017-02-15 ⋅ Palo Alto Networks Unit 42 ⋅ Bryan Lee, Robert Falcone
Magic Hound Campaign Attacks Saudi Targets
Leash MPKBot pupy Rocket Kitten
2017-02-10 ⋅ ⋅ JPCERT/CC ⋅ Shusei Tomonaga
Malware that infects using PowerSploit
pupy
2017-01-23 ⋅ Symantec ⋅ Symantec Security Response
Greenbug cyberespionage group targeting Middle East, possible links to Shamoon
DistTrack ISMDoor Greenbug
2017-01-23 ⋅ Symantec ⋅ Symantec Security Response
Greenbug cyberespionage group targeting Middle East, possible links to Shamoon
DistTrack ISMDoor Greenbug
2016-10-04 ⋅ Palo Alto Networks Unit 42 ⋅ Josh Grunzweig, Robert Falcone
OilRig Malware Campaign Updates Toolset and Expands Targets
Helminth
2016-05-26 ⋅ Palo Alto Networks Unit 42 ⋅ Bryan Lee, Robert Falcone
The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor
Helminth
2016-05-22 ⋅ FireEye ⋅ Sudeep Singh, Yin Hong Chang
Targeted Attacks against Banks in the Middle East
Helminth OilRig
Credits: MISP Project