Oil Rig Malware Campaign Updates Toolset and Expands Targets
Summary: Unit 42 reports that the OilRig group has updated its Clayslide delivery documents and Helminth backdoor, and expanded targeting beyond Saudi Arabia to a company in Qatar and government organizations in Turkey, Israel and the United States. The group continues to use spear-phishing emails with malicious Microsoft Excel documents, and researchers identified four distinct Helminth variants over five months - update.vbs, fireeye.vbs, upd.vbs and komisova.vbs - that differ mainly in the domains and IP addresses they use.
Key Takeaway: The malware is described as not terribly sophisticated, but its DNS command-and-control keeps it under the radar at many establishments - and the attackers were observed issuing hands-on commands, including FTP connections and reconnaissance, to a honeypot at seemingly random intervals.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026