MalwareUsed by 1 actor

Veaty

Veaty is a backdoor associated with Iranian cyber-espionage activity, particularly operations attributed to APT34, also known as OilRig, with reporting placing its use in campaigns against Iraqi government entities and other government targets in the Gulf region. It has been referenced as part of the broader Project CAV3RN malware ecosystem alongside other backdoors and communication components used in modular post-compromise operations. Detection reporting indicates Veaty is implemented as an MSIL executable and includes email-based command-and-control functionality. Its documented role is consistent with covert remote access and operator tasking in targeted intrusions conducted for espionage purposes. Available reporting does not provide enough high-confidence technical detail to support a more granular characterization of its internal capabilities beyond its use as a backdoor.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

OilRig

Use of compromised infrastructure belonging to entities in regions it targets, as observed in Solar and Veaty malware

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

“Initial access continued to rely on spear phishing — delivering macro-enabled documents or malicious links …” / “Iranian-linked threat actors have commonly used phishing (T1566) as the primary vector for initial access …”

Execution

1 technique

T1204User ExecutionEvidence1

“…often leading to execution via user execution (T1204) of malicious files …”

Stealth

2 techniques

T1036MasqueradingEvidence1

Defense evasion has remained a critical phase, where threat actors employ multiple obfuscation techniques (T1140) and masquerading (T1036) to bypass security controls.

T1140Deobfuscate/Decode Files or InformationEvidence1

“Defense evasion … employ multiple obfuscation techniques (T1140) …” plus described obfuscation (polyglots, XOR, double extensions, packed payloads, layered encryption).

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Finally, for command and control and exfiltration, Iranian-linked groups most commonly rely on application layer protocols (T1071), such as HTTP

T1071.004DNSEvidence1

These backdoors relied on custom DNS tunneling and email-based command-and-control communications

T1572Protocol TunnelingEvidence1

“custom DNS tunneling … hallmark” / “proxy-chaining … protocol tunneling tools such as Ngrok and ZeroTier”

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

the hacker newsNews

Aug 17, 2026

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Referenced as comparative malware associated with use of compromised regional infrastructure.

cyberveilleNews

Jul 21, 2026

Project CAV3RN : nouveau module C2 via Outlook Calendar et récupération de config par DNS AAAA | CyberVeille

Named backdoor listed among malware/tools, without substantive discussion in this reference.

trellix blogNews

Mar 2, 2026

The Iranian Cyber Capability 2026

APT34 backdoor used in multi-stage intrusion campaigns against Iraqi government entities.

detections digest rulecheckNews

Oct 20, 2025

Detections Digest #20251020

MSIL-based backdoor for Windows, using email as a command and control channel.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Veaty