Procedure examples

OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of `SYSTEM`.

OilRig has delivered malicious links to achieve execution on the target system.

OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.

OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.

OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok.

OilRig has used macros to verify if a mouse is connected to a compromised machine.

OilRig has used web shells, often to maintain access to a victim network.

OilRig has used a compromised Domain Controller to create a service on a remote host.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

OilRig has signed its malware with stolen certificates.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.

OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.

OilRig has registered a password filter DLL in order to drop malware.

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.

OilRig has sent spearphising emails with malicious links to potential victims.

OilRig has used LinkedIn to send spearphishing links.

OilRig has used the Plink utility and other tools to create tunnels to C2 servers.

OilRig used the PowerExchange utility and other tools to create tunnels to C2 servers.

OilRig has set up fake VPN portals, conference sign ups, and job application websites to target victims.

OilRig has compromised email accounts to send phishing emails.

OilRig actively developed and used a series of downloaders during 2022.

OilRig has made use of the publicly available tools including Plink and Mimikatz.

OilRig has obtained stolen code signing certificates to digitally sign malware.

OilRig has hosted malware on fake websites designed to target specific audiences.

OilRig has modified Windows firewall rules to enable remote access.