Malware

APT34 Malware

The term 'apt34_malware' refers to malware attributed to the Iranian APT34 (Oilrig) group, a state-sponsored cyber-espionage actor. While the provided content does not include actual malware source code, it references previous leaks (notably by the pseudonym Lab Dookhtegam) that exposed APT34 malware source code and operational data. APT34 is known for targeting a wide range of industries, including airlines, travel booking sites, insurance, IT, telecom firms, and government agencies worldwide. Their campaigns have focused on data theft, such as retrieving passenger manifests, reservations, and payment card numbers. The group has also attempted, though unsuccessfully, to develop malware targeting SCADA industrial control systems. The leaks have included images of source code, C2 server backends, and victim lists, but not the binaries or full source code for the malware itself. The exposure of these operational details has forced APT34 and related Iranian groups to re-tool and delay future operations. Indicators of compromise are not directly mentioned in the content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

zdnet zero dayNews

May 9, 2019

New leaks of Iranian cyber-espionage operations hit Telegram and the Dark Web

Malware strains associated with APT34 (Oilrig), an Iranian government-backed cyber-espionage group. The leak included source code for several malware tools used by the group for espionage operations.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

APT34 Malware