Threat actor
OilRig
Iran · espionage
Tracked by CyberSIXT since 2 Mar
- Articles · all time
- 3
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 3
Names and sources
- CHRYSENE
- Named by CyberSIXT coverage
- APT34
- Named by Malpedia · chrysene
- CHRYSENE
- Named by Malpedia · chrysene
- Cobalt Gypsy
- Named by Malpedia · chrysene
- Crambus
- Named by Malpedia · chrysene
- EUROPIUM
- Named by Malpedia · chrysene
- Greenbug
- Named by Malpedia · chrysene
- HELIX KITTEN
- Named by Malpedia · chrysene
All 47 names
- Hazel Sandstorm
- Named by Malpedia · chrysene
- OilRig
- Named by Malpedia · chrysene
- APT34
- Named by Microsoft · Hazel Sandstorm
- COBALT GYPSY
- Named by Microsoft · Hazel Sandstorm
- Crambus
- Named by Microsoft · Hazel Sandstorm
- EUROPIUM
- Named by Microsoft · Hazel Sandstorm
- HELIX KITTEN
- Named by Microsoft · Hazel Sandstorm
- Hazel Sandstorm
- Named by Microsoft · Hazel Sandstorm
- OilRig
- Named by Microsoft · Hazel Sandstorm
- APT 34
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- ATK40
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- CHRYSENE
- Named by MISP Galaxy · a0082cfa-32e2-42b8-92d8-5c7a7409dcf1
- Cobalt Gypsy
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- Crambus
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- EUROPIUM
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- Earth Simnavaz
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- Evasive Serpens
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- G0049
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- Greenbug
- Named by MISP Galaxy · a0082cfa-32e2-42b8-92d8-5c7a7409dcf1
- Hazel Sandstorm
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- Helix Kitten
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- IRN2
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- OilRig
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- SOLAR ION
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- TA452
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- Twisted Kitten
- Named by MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba
- APT34
- Named by MITRE ATT&CK® · G0049
- COBALT GYPSY
- Named by MITRE ATT&CK® · G0049
- Crambus
- Named by MITRE ATT&CK® · G0049
- EUROPIUM
- Named by MITRE ATT&CK® · G0049
- Earth Simnavaz
- Named by MITRE ATT&CK® · G0049
- Evasive Serpens
- Named by MITRE ATT&CK® · G0049
- Hazel Sandstorm
- Named by MITRE ATT&CK® · G0049
- Helix Kitten
- Named by MITRE ATT&CK® · G0049
- IRN2
- Named by MITRE ATT&CK® · G0049
- ITG13
- Named by MITRE ATT&CK® · G0049
- OilRig
- Named by MITRE ATT&CK® · G0049
- TA452
- Named by MITRE ATT&CK® · G0049
- a0082cfa-32e2-42b8-92d8-5c7a7409dcf1
- Named by CyberSIXT coverage
Attributed facts
- category
- state (Microsoft · Hazel Sandstorm)
- motivation
- espionage (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- origin
- Iran (Microsoft · Hazel Sandstorm)
- origin
- Iran (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Chemical (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Civil society (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Energy (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Engineering (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Finance (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Government (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Government, Administration (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Other (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Private sector (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sector
- Telecoms (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sponsor
- Iran (Islamic Republic of) (MISP Galaxy · 42be2a84-5a5c-4c6d-9864-3f09d75bb0ba)
- sponsor
- Unknown (MISP Galaxy · a0082cfa-32e2-42b8-92d8-5c7a7409dcf1)
Malware and tools
Mimikatz (MITRE ATT&CK® · G0049) PsExec (MITRE ATT&CK® · G0049) Net (MITRE ATT&CK® · G0049) Tasklist (MITRE ATT&CK® · G0049) Reg (MITRE ATT&CK® · G0049) ftp (MITRE ATT&CK® · G0049) Systeminfo (MITRE ATT&CK® · G0049) ipconfig (MITRE ATT&CK® · G0049) netstat (MITRE ATT&CK® · G0049) certutil (MITRE ATT&CK® · G0049) Helminth (MITRE ATT&CK® · G0049) POWRUNER (MITRE ATT&CK® · G0049) SEASHARPEE (MITRE ATT&CK® · G0049) ISMInjector (MITRE ATT&CK® · G0049) RGDoor (MITRE ATT&CK® · G0049) OopsIE (MITRE ATT&CK® · G0049) QUADAGENT (MITRE ATT&CK® · G0049) LaZagne (MITRE ATT&CK® · G0049) BONDUPDATER (MITRE ATT&CK® · G0049) RDAT (MITRE ATT&CK® · G0049) ngrok (MITRE ATT&CK® · G0049) SideTwist (MITRE ATT&CK® · G0049) ZeroCleare (MITRE ATT&CK® · G0049) Solar (MITRE ATT&CK® · G0049) SampleCheck5000 (MITRE ATT&CK® · G0049) Mango (MITRE ATT&CK® · G0049) ODAgent (MITRE ATT&CK® · G0049) OilCheck (MITRE ATT&CK® · G0049) OilBooster (MITRE ATT&CK® · G0049) PowerExchange (MITRE ATT&CK® · G0049)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0049
Stealth
- T1027.005
- Indicator Removal from Tools
Discovery
Command and Control
- T1008
- Fallback Channels
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on IsraelSecurityOnline
- OilRig hides C2 commands inside Outlook calendar eventsSecurelist
- Epic Fury cyberwar pits Iran's APT33/34 against US basesSOCRadar · first in our coverage