Ankura CTIX FLASH Update - December 15, 2023

Malware Activity

OilRig Group Deploys 3 New Malware Downloaders

Cybersecurity researchers have published reports showing that throughout 2022, OilRig (an Iranian state-sponsored threat actor also known as APT34, Crambus, Cobalt Gypsy, Hazel Sandstorm, and Helix Kitten) was observed deploying three (3) new downloader malware strains named ODAgent, OilCheck, and OilBooster, along with an updated version of a known downloader called SampleCheck5000 (SC5k), to maintain persistent access to victim organizations primarily in Israel. Active since 2014, OilRig Group mainly targets entities in the Middle East. The downloaders are notable for using legitimate cloud service APIs, like Microsoft Graph OneDrive, Outlook APIs, and Microsoft Office Exchange Web Services (EWS) API, for command-and-control (C2) and data exfiltration. This strategy aims to blend malicious activities with authentic network traffic, covering up the attack infrastructure. The targets of these