Oil Rig Deploys “ALMA Communicator” – DNS Tunneling Trojan
Summary: Unit 42 reports that the OilRig threat group used a new version of its Clayslide delivery document to install a custom backdoor Trojan its developer calls "ALMA Communicator," alongside a Mimikatz variant, in an attack believed to have targeted an individual at a public utilities company in the Middle East. ALMA Communicator communicates exclusively over DNS tunneling, sending 10 bytes per outbound request and receiving 4 bytes per DNS response, which Unit 42 says is why the delivery document dropped Mimikatz directly rather than downloading it later.
Key Takeaway: At 4 bytes per DNS response, pulling the 758,272-byte Mimikatz tool over ALMA's channel would take 189,568 DNS requests, so OilRig shipped the credential harvester inside the phishing document instead - a volume of DNS traffic your monitoring may never be tuned to notice.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026