Oil Rig Uses Updated BONDUPDATER to Target Middle Eastern Government
Summary: In August 2018, Unit 42 observed the OilRig group sending a subject-less spear-phishing email to a high-ranking office in a Middle Eastern government, carrying a malicious document named "N56.15.doc" whose macro installed an updated BONDUPDATER PowerShell Trojan. The new variant adds DNS TXT records to its DNS tunneling protocol for C2 communications, alongside the original A-record method, and uses a scheduled task running every minute for persistence.
What's compelling: BONDUPDATER's C2 traffic rides inside DNS queries to the domain "withyourface[.]com", so an actor that has operated against Middle Eastern governments since at least mid-2016 can task and retrieve files without a single conventional outbound connection to flag.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026