Loading story…
APT34, also tracked as OilRig and Helix Kitten, ran targeted phishing campaigns that used malicious Microsoft Word documents to deliver new malware closely related to the SideTwist backdoor. One lure posed as a Seychelles Licensing Authority registration form with pricing in Saudi riyals, indicating likely targeting in Saudi Arabia, while another impersonated marketing services firm GGMS to reach enterprise victims. In both cases, the documents dropped .NET payloads—identified as Menorah and SystemFailureReporter.exe—that gave the operators espionage capabilities including host fingerprinting, command execution, file listing, file upload, and file download.
The malware established persistence through scheduled tasks, including OneDriveStandaloneUpdater and another task triggered every five minutes via an update.xml file. The implants communicated over HTTP with command-and-control infrastructure including tecforsc-001-site1.gtempurl.com and 11.0.188.38:443, with one report noting that the latter, a U.S. Department of Defense-owned IP address, was likely a decoy or testing endpoint intended to shield operational infrastructure. Researchers said the activity shows APT34 continuing to evolve SideTwist-style tooling while relying on straightforward phishing and persistence methods for cyberespionage in the Middle East and against enterprise targets.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
NSFOCUS states that APT34, also known as OilRig or Helix Kitten, has been active since 2014 and has conducted cyber espionage and sabotage operations in the Middle East.
Trend Micro analyzed Menorah as a cyberespionage malware family with system fingerprinting, command execution, file listing, upload, and download capabilities, communicating with tecforsc-001-site1.gtempurl.com over HTTP every 32 seconds. The report found significant similarities between Menorah and the SideTwist backdoor, including victim fingerprinting and command-and-control communication patterns.
Trend Micro described a targeted phishing attack attributed to APT34 that used a malicious Word document, “MyCv.doc,” disguised as a Seychelles Licensing Authority registration form with Saudi Riyal pricing, suggesting a likely Saudi Arabian target. The document’s macros dropped Menorah.exe and created a scheduled task named “OneDriveStandaloneUpdater” for persistence.
NSFOCUS analyzed the dropped malware as a SideTwist variant that communicated over HTTP with 11.0.188.38:443, collected host identifiers, used an update.xml anti-sandbox check, and parsed commands hidden in HTML script tags. The malware supported command execution, file download, and file upload, and NSFOCUS assessed the DoD-owned IP likely served as a testing or decoy C2 rather than an active operational server.
NSFOCUS Security Labs reported a new phishing campaign attributed to APT34 in which attackers impersonated Ganjavi Global Marketing Services and used a malicious Word document, “GGMS Overview.doc,” to target enterprise victims. The macro dropped SystemFailureReporter.exe, created update.xml, and established persistence with a scheduled task running every five minutes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Iran-linked threat group **OilRig** (also tracked as **APT34**, **Crambus**, and in some reporting linked with **Lyceum/Hexane**) has conducted a long-running cyberespionage campaign against government, diplomatic, technology, medical, energy, and utility targets across the Middle East and nearby regions. Researchers tied the group to spear-phishing operations that used compromised business email accounts, fake **University of Oxford** conference and job sites, trojanized VPN installers, and malicious Office documents to deliver malware including **Helminth**, **ALMA Communicator**, **Marlin**, and other custom backdoors. In one notable case, malware was digitally signed with a legitimate **AI Squared** code-signing certificate, making the payloads appear trustworthy and highlighting either certificate theft or compromise. The intrusions evolved into deeper post-compromise operations featuring credential theft, webshell deployment, lateral movement, and covert command-and-control. Reports described OilRig-linked operators using **Mimikatz**, **PsExec**, **Plink**, scheduled tasks, SSH tunnels, spoofed webmail portals, and IIS backdoors such as **RGDoor**, while newer tradecraft included **DNS tunneling**, **OneDrive API** communications, and the **PowerExchange** technique that abused a compromised Exchange mailbox for C2. A later campaign against a Middle Eastern government reportedly compromised at least 12 systems, stole files and passwords, enabled remote RDP access, and deployed malware families including **Backdoor.Tokel**, **Trojan.Dirps**, and **Infostealer.Clipog**, underscoring that OilRig remains an active and adaptable Iranian espionage threat.
Aug 15, 2026
Multiple reporting described **phishing-led intrusions** that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters **APT36/Transparent Tribe** and **SideCopy**, using malicious attachments/links to deliver Windows and Linux payloads including **Geta RAT**, **Ares RAT**, and **DeskRAT**. One documented Windows chain used a malicious `LNK` that invoked `mshta.exe` to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms. Separately, a newly reported **CrashFix** campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary **Python implant** plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and **Active Directory** targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new **XWorm** variant via a malicious Excel attachment exploiting `CVE-2018-0802` to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into `Msbuild.exe`, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.
Jun 29, 2026