State-backedIran MITRE G0059

OilRig

Also known as Twisted Kitten, Cobalt Gypsy, Crambus, Helix Kitten, APT 34, APT34, IRN2, ATK40, G0049, Evasive Serpens, Hazel Sandstorm, EUROPIUM, TA452, Earth Simnavaz, SOLAR ION, Magic Hound, TA453, COBALT ILLUSION, Charming Kitten, ITG18

3mentions, 7 days

3mentions, 30 days

Nov 3, 2026last mentioned

OilRig is an Iranian threat group operating primarily in the Middle East by targeting organizations in this region that are in a variety of different industries; however, this group has occasionally targeted organizations outside of the Middle East as well. It also appears OilRig carries out supply chain attacks, where the threat group leverages the trust relationship between organizations to attack their primary targets. OilRig is an active and organized threat group, which is evident based on their systematic targeting of specific organizations that appear to be carefully chosen for strategic purposes. Attacks attributed to this group primarily rely on social engineering to exploit the human rather than software vulnerabilities; however, on occasion this group has used recently patched vulnerabilities in the delivery phase of their attacks. The lack of software vulnerability exploitation does not necessarily suggest a lack of sophistication, as OilRig has shown maturity in other aspects of their operations. Such maturities involve: -Organized evasion testing used the during development of their tools. -Use of custom DNS Tunneling protocols for command and control (C2) and data exfiltration. -Custom web-shells and backdoors used to persistently access servers. OilRig relies on stolen account credentials for lateral movement. After OilRig gains access to a system, they use credential dumping tools, such as Mimikatz, to steal credentials to accounts logged into the compromised

Targets: Government, Private sector, Civil society, Israel, Kuwait, United States, Turkey, Saudi Arabia, Qatar, Lebanon, Middle East

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1005 Data from Local System T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1016.002 Wi-Fi Discovery T1018 Remote System Discovery T1021.001 Remote Desktop Protocol T1027.010 Command Obfuscation T1027.013 Encrypted/Encoded File T1033 System Owner/User Discovery T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1036.010 Masquerade Account Name T1046 Network Service Discovery T1047 Windows Management Instrumentation T1049 System Network Connections Discovery T1053.005 Scheduled Task T1056.001 Keylogging T1057 Process Discovery T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1070.003 Clear Command History T1070.004 File Deletion T1071 Application Layer Protocol T1071.001 Web Protocols T1078.001 Default Accounts T1078.002 Domain Accounts T1082 System Information Discovery T1083 File and Directory Discovery T1087.003 Email Account T1090 Proxy T1098.002 Additional Email Delegate Permissions T1098.007 Additional Local or Domain Groups T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1112 Modify Registry T1113 Screen Capture T1114 Email Collection T1114.001 Local Email Collection T1114.002 Remote Email Collection T1136.001 Local Account T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1204.001 Malicious Link T1204.002 Malicious File T1218.011 Rundll32 T1482 Domain Trust Discovery T1486 Data Encrypted for Impact T1505.003 Web Shell T1547.001 Registry Run Keys / Startup Folder T1560.001 Archive via Utility T1564.003 Hidden Window T1566.002 Spearphishing Link T1566.003 Spearphishing via Service T1567 Exfiltration Over Web Service T1570 Lateral Tool Transfer T1571 Non-Standard Port T1572 Protocol Tunneling T1573 Encrypted Channel T1583.001 Domains T1583.006 Web Services T1584.001 Domains T1585.001 Social Media Accounts T1585.002 Email Accounts T1586.002 Email Accounts T1588.002 Tool T1589 Gather Victim Identity Information T1589.001 Credentials T1589.002 Email Addresses T1590.005 IP Addresses T1591.001 Determine Physical Locations T1592.002 Software T1595.002 Vulnerability Scanning T1598.003 Spearphishing Link T1685 Disable or Modify Tools T1685.001 Disable or Modify Windows Event Log T1686.003 Windows Host Firewall

Recent activity

🚨 🇮🇷 Iran-linked DarkBlinders hackers breached a government cloud environment in Iraqi Kurdistan and stole at least 1 GB of data. The cyberespionage campaign
mastodon · Nov 3, 2026
Charming Kitten APT Adversary Simulation https:// infosec.pub/post/54309761 [ https:// infosec.pub/u/digicat ] # blueteamsec
mastodon · Oct 31, 2026
Charming Kitten APT Adversary Simulation
reddit · Oct 31, 2026

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.