Symantec Crambus OCT 2023

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.

OilRig has used Wireshark’s usbcapcmd utility to capture USB traffic.

OilRig has named a downloaded copy of the Plink tunneling utility as \ProgramData\Adobe.exe.

PowerExchange can exfiltrate files via its email C2 channel.

OilRig has used WMI for execution.

OilRig has employed keyloggers including KEYPUNCH and LONGWATCH.

OilRig has run tasklist on a victim's machine and used infostealers to capture processes.

PowerExchange can use PowerShell to execute commands received from C2.

OilRig has used net localgroup administrators to find local administrators on compromised systems.

PowerExchange can receive and send back the results of executed C2 commands through email.

OilRig has run hostname and systeminfo on a victim.

PowerExchange can decode Base64-encoded files and call `WriteAllBytes` to write the files to compromised hosts.

OilRig has used reg.exe to modify system configuration.

OilRig has used infostealer tools to copy clipboard data.

PowerExchange can decode and decrypt C2 commands received via email.

OilRig has used a compromised Domain Controller to create a service on a remote host.

OilRig has used the Plink utility and other tools to create tunnels to C2 servers.

OilRig has made use of the publicly available tools including Plink and Mimikatz.

OilRig has modified Windows firewall rules to enable remote access.