Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Behind the Scenes with Oil Rig

Summary: Unit 42 analyzed a leaked data dump it assesses as consistent with OilRig (also tracked as APT34 and Helix Kitten) operations, identifying nearly 13,000 stolen credentials, over 100 deployed webshells, and roughly a dozen backdoor sessions across 27 countries, 97 organizations, and 18 industries. The dump, promoted in March 2019 by Twitter accounts @Mr_L4nnist3r and @dookhtegan, exposed the group's internal tool names - Glimpse and Poison Frog, both previously tracked as BONDUPDATER - along with their server components and webshell source code.

Why it matters: Nearly 13,000 credentials from 15 organizations, largely in the Middle East, let OilRig log in as legitimate users rather than deploy malware - the mode most protections are not built to catch. The leak also handed the public the group's own command-and-control panels and setup documentation, so defenders now know exactly what Glimpse and Poison Frog look like on a compromised host.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related