Oil Rig targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE
Summary: Unit 42 reports that OilRig used a spear phishing email with an Arabic subject translating to "Business continuity management training" to deliver a variant of the OopsIE trojan to a Middle Eastern government agency, sent to a user group address rather than an individual. The new variant adds anti-VM and anti-sandbox checks, including a CPU fan WMI query, a CPU temperature check previously used by GravityRAT, and a time zone check that stops execution unless the system is set to Iran, Arab, Arabia or Middle East daylight time.
What's compelling: The trojan refuses to run outside five specific Windows time zones spanning 10 countries, so the malware itself is scoped to a defined set of target nations - and it exits silently on any machine that fails its checks, including some physical systems that lack the WMI queries it relies on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026