OopsIE! Oil Rig Uses Three Dollars to Deliver New Trojan
Summary: Unit 42 observed the OilRig group attack a Middle Eastern insurance agency on January 8, 2018, and a Middle Eastern financial institution on January 16, 2018, delivering a new Trojan tracked as OopsIE. The first attack used a ThreeDollars document named Seminar-Invitation.doc with a spoofed sender address tied to a global financial institution's Lebanese domain, while the second delivered OopsIE directly from its command and control server, likely via a spear phishing link, to an organization OilRig had already targeted in January 2017.
What you should know: The January 16 victim had been hit a year earlier, and Unit 42 assesses the direct-delivery shift may reflect that organization having countered OilRig's known macro-document tactics - meaning defenses that worked once did not end the targeting. The OopsIE Trojan beacons over HTTP through the InternetExplorer application object so its requests resemble legitimate browser traffic, and it persists via a scheduled task running every three minutes against the C2 domain www.msoffice365cdn[.]com.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026