The Oil Rig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor
Summary: Unit 42 documented a campaign it named OilRig, with targeted attacks in May 2016 against financial institutions and technology organizations in Saudi Arabia, plus artifacts pointing to defense-industry targeting tied to an earlier fall 2015 wave. The attacks delivered a backdoor called Helminth in two variants - a VBScript and PowerShell script installed via malicious Excel macros (tracked as Clayslide, with spear-phishing emails sent May 4 to May 12) and a standalone Windows executable installed by the HerHer dropper - both using HTTP and DNS queries to command-and-control servers.
Bottom line: The executable variant added keystroke and clipboard logging, and hardcoded group values in the samples named Saudi telecommunications and defense organizations, so the target set extended beyond the financial firms first hit. WHOIS records for the C2 domains carried Tehran geolocations and chmail.ir addresses, which Unit 42 called compelling but easily falsified indicators that the operators may be based in Iran.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026