Striking Oil: A Closer Look at Adversary Infrastructure
Summary: Unit 42 traced IP addresses that logged into the TwoFace webshell it reported in July and found a larger infrastructure split by function: credential harvesters mimicking legitimate webmail portals, a compromised system used to mask the actor's location, and command-and-control systems. The harvesters targeted organizations that are Israeli-based or have strong Israeli ties, and the researchers linked the operators to the OilRig campaign through shared tools, a specific Mimikatz sample, and overlapping Middle East targeting.
Key Takeaway: The same operator had access to both the TwoFace webshell and purpose-built credential harvesters aimed at a specific region and set of companies, which points to a targeted mission rather than generic phishing. A single webshell led investigators to additional shells, four more compromised Middle East webservers, and a backup IIS backdoor (RGDoor) - so one compromised host was never the whole of the intrusion.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026