Oil Rig Targets Technology Service Provider and Government Agency with QUADAGENT
Summary: Unit 42 observed three waves of OilRig attacks between May and June 2018, launched from a compromised Middle East government agency email account against a technology services provider and another government entity in the same nation-state. The attacks delivered a PowerShell backdoor called QUADAGENT, the 12th custom tool Unit 42 has documented the group using, packaged in PE files and obfuscated with the open-source Invoke-Obfuscation toolkit.
Bottom line: The group reused the same QUADAGENT payload across all three waves, changing only the C2 server and obfuscation so each sample looked different enough to slip past security controls - and the C2 fell back from HTTPS to HTTP to DNS tunneling when earlier channels failed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026