Loading story…
Palo Alto Networks' Unit 42 reported that the OilRig threat group deployed ALMA Communicator, a malware family designed to use DNS tunneling for command-and-control communications. The activity links OilRig to a covert channel that can blend malicious traffic into normal DNS requests, helping operators maintain access and exchange data while reducing the chance of detection by traditional network monitoring.
The report identifies ALMA Communicator as part of OilRig's broader intrusion toolkit and highlights DNS-based communications as a key tradecraft element in the group's operations. For defenders, the findings underscore the need to inspect anomalous DNS behavior, hunt for suspicious beaconing patterns, and review endpoint activity associated with malware that abuses DNS for persistence and remote control.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a report describing OilRig's use of the 'ALMA Communicator' DNS tunneling trojan. The reference indicates public disclosure of technical details about the malware and its deployment.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-linked threat group **OilRig** (also tracked as **APT34**, **Crambus**, and in some reporting linked with **Lyceum/Hexane**) has conducted a long-running cyberespionage campaign against government, diplomatic, technology, medical, energy, and utility targets across the Middle East and nearby regions. Researchers tied the group to spear-phishing operations that used compromised business email accounts, fake **University of Oxford** conference and job sites, trojanized VPN installers, and malicious Office documents to deliver malware including **Helminth**, **ALMA Communicator**, **Marlin**, and other custom backdoors. In one notable case, malware was digitally signed with a legitimate **AI Squared** code-signing certificate, making the payloads appear trustworthy and highlighting either certificate theft or compromise. The intrusions evolved into deeper post-compromise operations featuring credential theft, webshell deployment, lateral movement, and covert command-and-control. Reports described OilRig-linked operators using **Mimikatz**, **PsExec**, **Plink**, scheduled tasks, SSH tunnels, spoofed webmail portals, and IIS backdoors such as **RGDoor**, while newer tradecraft included **DNS tunneling**, **OneDrive API** communications, and the **PowerExchange** technique that abused a compromised Exchange mailbox for C2. A later campaign against a Middle Eastern government reportedly compromised at least 12 systems, stole files and passwords, enabled remote RDP access, and deployed malware families including **Backdoor.Tokel**, **Trojan.Dirps**, and **Infostealer.Clipog**, underscoring that OilRig remains an active and adaptable Iranian espionage threat.
Aug 15, 2026
An Iran-linked espionage cluster tracked as **Greenbug** and **OilRig/APT34** targeted telecommunications providers in South Asia while relying on a broader toolkit built for stealthy persistence, credential theft, and covert command-and-control. Symantec reported intrusions spanning at least April 2019 to April 2020 in which attackers used email lures and malicious `CHM` and `HTA` files for initial access, then moved through victim networks with tools including **Covenant**, **Cobalt Strike**, **Mimikatz**, **Plink**, **Bitvise**, **PowerShell**, **BITSAdmin**, and webshells. In one intrusion that lasted about six months, the operators focused on harvesting credentials, maintaining privileged access, tunneling into internal systems, and testing access to database servers inside telecom environments. Multiple reports tie that activity to established OilRig tradecraft, including Exchange-focused `.NET` webshells planted under `/owa/auth/`, scheduled-task persistence, and extensive use of **DNS tunneling** to hide C2 and exfiltration traffic. Unit 42 and IronNet described tools such as **ISMAgent**, **Helminth**, **ALMACommunicator**, **BONDUPDATER**, **QUADAGENT**, and **PoisonFrog**, which encoded tasking and stolen data into crafted DNS subdomains and used `A`, `AAAA`, or `TXT` responses to pass commands. NSFOCUS said a leaked APT34 toolkit exposed PowerShell RATs, webshells, the **Webmask** DNS/HTTP hijacking tool, and more than 12,000 weak passwords, while earlier ClearSky reporting showed Greenbug delivering **ISMAgent** through an Office exploit for `CVE-2017-0199` and `certutil.exe`-decoded payloads, underscoring a long-running pattern of low-profile access operations and intelligence collection.
Aug 15, 2026
Palo Alto Networks Unit 42 reported that a large share of malware command-and-control traffic is avoiding DNS-based detection by connecting directly to IP addresses. In an analysis of more than 4 million dynamic malware reports collected over 30 days, 20.11% of samples showed C2 activity, and 45.32% of those samples made at least one direct-to-IP connection. Those direct connections accounted for 23.17% of all observed C2 attempts, indicating that DNS-focused controls can miss a substantial portion of malicious outbound traffic. The research linked this technique to multiple active threats, including **Phorpiex** ransomware droppers using hard-coded IP infrastructure, an obfuscated `\GET` data-exfiltration campaign hosted on Brazilian public cloud infrastructure, **SectopRAT** activity targeting educational institutions, and IoT botnets such as **Mozi** and a Mirai variant known as **Boatnet**. Unit 42 said the findings support a **Zero Trust IP** enforcement model that permits outbound connections only to IP addresses previously validated through trusted DNS resolution, aiming to close a visibility gap exploited by malware that communicates outside normal domain-based controls.
Aug 5, 2026