not MITRE’s ATT&CK Group
OilRig
How MITRE ATT&CK characterizes this group1: OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on…
Attributed to Iran — MOIS-aligned by government advisory.111
Read as a state-directed operator, not a smash-and-grab.
A nation-state classification means patience, tradecraft, and an intelligence objective. When this name attaches to a vulnerability, the question shifts from “will someone exploit it” to “has a well-resourced service already built it into an operation.” All tradecraft below is sourced to MITRE ATT&CK.
Known for
— signature moves, each sourced to ATT&CKTradecraft heatmap
— ATT&CK techniques mapped onto the five attacker-outcome narrativesEach row is a documented technique (MITRE ATT&CK). Each column is one of the five attacker-outcome narratives a defender funds against. A filled cell means this technique’s own ATT&CK tactic defensibly advances that outcome. The mapping of technique→outcome is our editorial alignment over ATT&CK's tactic data, not a separately-sourced MITRE edge. A filled cell means one of the technique's own ATT&CK tactics defensibly advances that outcome; enabler tactics (C2, Defense Evasion, Discovery) heat no column.
Reach: this actor’s cited techniques light columns 1·2·3·4 — furthest is 4 · Data at risk. (furthest-position idiom, reused from the landing map).
Arsenal
— named tools & malware ATT&CK attributes to this groupATT&CK attributes 30 tools/malware to G0049 in total; the full list is on the group page.
Campaign highlights
— attributed operations in the ATT&CK recordOuter Space — ATT&CK Campaign C0042
Juicy Mix — ATT&CK Campaign C0044
Latest activity
— with explicit confidence, and what we cannot yet claimsnapshot
The most recent cited activity in this card is the ATT&CK record itself. We do not paste a “last seen this week” line we cannot source. Recency from secondary reporting appears here only when attached to a named advisory.
These are not confirmed attribution. An inferred link is a structural ATT&CK chain (this group uses a tool whose reference cites the CVE); it is back-cited to the original report and never claims the source names the group.
ATT&CK attributes BONDUPDATER (S0360) to this group, and that software’s ATT&CK reference cites CVE-2017-11882. Structural chain — not a statement that the report names the group.
original report (cited on the ATT&CK software page) ↗ATT&CK attributes POWRUNER (S0184) to this group, and that software’s ATT&CK reference cites CVE-2017-11882. Structural chain — not a statement that the report names the group.
original report (cited on the ATT&CK software page) ↗