Oil Rig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group
Summary: Unit 42 reported that on July 16, 2017, actors tied to the OilRig campaign emailed five individuals at a Middle Eastern technology organization with a modified Clayslide Excel document that ran a macro and installed a new ISMDoor variant tracked as ISMAgent. The payload, servicereset.exe, uses HTTP beacons to a C2 domain (ntpupdateserver[.]com) with DNS tunneling as a fallback, and a scheduled task named OfficeServicesStatus set to run every three minutes.
What you should know: The same organization was targeted by OilRig in August 2016, and the operators returned a year later with a rebuilt payload and a persistence task firing every three minutes, so a single enabled macro can mean recurring execution on a host long after the email is forgotten.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026