Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Oil Rig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory

Summary: Unit 42 found a variant of an OilRig tool it calls RDAT using a novel email-based command and control channel that hid commands and exfiltrated data inside bitmap images attached to emails, in an April 2020 attack on a Middle Eastern telecommunications organization. The sample carrying this EWS-based steganography channel was compiled on July 24, 2018, and RDAT has been under active development since 2017, with samples compiled as recently as April 2020 configured to use new infrastructure at sharjatv[.]com and wwmal[.]com.

Key Takeaway: The payload creates an inbox rule named "ExchangeRule" to move the actor's emails into the junk folder and then reads commands hidden in BMP attachments, so the C2 traffic looks like ordinary Exchange Web Services requests with a "firefox" User-Agent rather than anything your network perimeter would flag.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related