Oil Rig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan
Summary: Unit 42 reports that the OilRig group, which it first identified in May 2016, used a new tool called ISMAgent in July 2017 attacks and in August 2017 developed a Trojan it calls 'Agent Injector,' tracked as ISMInjector, to install the ISMAgent backdoor. On August 23, 2017, OilRig targeted a United Arab Emirates government organization with a spear-phishing email titled 'Importan Issue' carrying two Zip archives, and header data indicated the message was sent through the victim organization's Outlook Web Access using Firefox 36.
Bottom line: The email came from an address on the same domain as its recipients and was sent through the organization's own OWA, consistent with Unit 42's assessment that OilRig harvested a legitimate user's credentials rather than spoofing the sender - so the message would not have looked external to anyone who received it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026