binarypublish
- The Iranian state-sponsored group known as OilRig has deployed three different downloader malware named ODAgent, OilCheck, and OilBooster throughout 2022 to maintain access to victim organizations based in Israel.
- The malware uses well-known cloud service APIs for command-and-control communication, blending with authentic network traffic to disguise the attacks.
- The targets include an organization in the healthcare sector, a manufacturing company, and a local governmental organization, all of which have been previously targeted by the group.
- ODAgent, first detected in February 2022, uses Microsoft’s OneDrive API for command-and-control communications, allowing the threat actor to download and execute payloads and exfiltrate staged files.
The attacks, according to a report shared with The Hacker News by Slovak cybersecurity company ESET, also used an updated version of a known OilRig downloader dubbed SampleCheck5000 (or SC5k). This strategy enables the attackers to blend with legitimate network traffic and disguise their attack infrastructure.
While it remains unclear how the attackers managed to compromise the targets, it is known that the targets have previously been targeted by the group. The OilRig group, also known variously as APT34, Crambus, Cobalt Gypsy, Hazel Sandstorm, and Helix Kitten, has been active since at least 2014, using a wide range of malware to target entities primarily in the Middle East.
The ODAgent downloader, first discovered in February 2022, utilizes Microsoft’s OneDrive API for command-and-control (C2) communications, enabling the infiltrators to download and execute payloads and exfiltrate staged files. SampleCheck5000, on the other hand, is designed to interact with a shared Microsoft Exchange mail account to download and execute additional OilRig tools using Microsoft Office Exchange Web Services (EWS) API.
OilBooster, like ODAgent, uses Microsoft’s OneDrive API for C2, while OilCheck employs the same technique as SampleCheck5000 to extract commands embedded in draft messages. However, instead of using the EWS API, OilCheck leverages Microsoft’s Graph API for network communications. OilBooster shares similarities with OilCheck in its use of the Microsoft Graph API to connect to a Microsoft Office 365 account.
According to the researchers at ESET, the downloaders use a shared (email or cloud storage) OilRig-operated account to exchange messages with the OilRig operators. Each account, typically accessed by multiple victims, is used to download commands and additional payloads staged by the operators and to upload command output and staged files.
