Oil Rig uses RGDoor IIS Backdoor on Targets in the Middle East
Summary: Unit 42 found actors installing an IIS backdoor it calls RGDoor on webservers belonging to eight Middle Eastern government organizations plus one financial and one educational institution, deployed as a secondary backdoor in case the TwoFace webshell is detected and removed. RGDoor is a C++ DLL loaded as a native IIS HTTP module that watches all inbound POST requests for a Cookie field containing "RGSESSIONID=", decrypts the payload with a single-byte XOR key, and executes one of three commands: "cmd$", "upload$" and "download$".
Why it matters: By default IIS does not log Cookie field values, so the channel carrying RGDoor's commands stays invisible unless an administrator explicitly enables Cookie logging in the W3C Logging Fields dialog. The group behind this has built a fallback path to regain access after remediation, which means removing the webshell you found may not remove the actor.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026