Trusted Design

OilRig Campaign Attack on Saudi Arabia Deliver Helminth Backdoor

概要

In May 2016, Unit 42 observed targeted attacks primarily focused on financial institutions and technology organizations within Saudi Arabia. Artifacts identified within the malware samples related to these attacks also suggest the targeting of the defense industry in Saudi Arabia, which appears to be related to an earlier wave of attacks carried out in the fall of 2015.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

Shamoon is back (score: 0.64)
From Shamoon to StoneDrill (score: 0.62)
Greenbug cyberespionage group targeting Middle East, possible links to Shamoon (score: 0.58)
Targets Middle Eastern Telecommunications Companies (score: 0.56)
SPEAR: A Threat Actor Resurfaces (score: 0.55)

このPulseに関連する脅威アクター (事実ベース)

Ember Bear

Score: 4.13

Matched TTPs:

T1491.002 - External Defacement

MITREへのリンク →

Sandworm Team

Score: 10.72

Matched TTPs:

T1491.002 - External Defacement
T1591.002 - Business Relationships
T1199 - Trusted Relationship

MITREへのリンク →

UNC3886

Score: 4.13

Matched TTPs:

T1681 - Search Threat Vendor Data

MITREへのリンク →

Contagious Interview

Score: 13.02

Matched TTPs:

T1681 - Search Threat Vendor Data
T1497 - Virtualization/Sandbox Evasion
T1657 - Financial Theft
T1566.003 - Spearphishing via Service

MITREへのリンク →

Dragonfly

Score: 3.84

Matched TTPs:

T1591.002 - Business Relationships

MITREへのリンク →

LAPSUS$

Score: 10.72

Matched TTPs:

T1591.002 - Business Relationships
T1199 - Trusted Relationship
T1578.002 - Create Cloud Instance

MITREへのリンク →

Saint Bear

Score: 3.84

Matched TTPs:

T1497 - Virtualization/Sandbox Evasion

MITREへのリンク →

Darkhotel

Score: 3.84

Matched TTPs:

T1497 - Virtualization/Sandbox Evasion

MITREへのリンク →

Kimsuky

Score: 5.27

Matched TTPs:

T1657 - Financial Theft
T1218.010 - Regsvr32

MITREへのリンク →

Storm-0501

Score: 5.27

Matched TTPs:

T1657 - Financial Theft
T1218.010 - Regsvr32

MITREへのリンク →

Scattered Spider

Score: 6.66

Matched TTPs:

T1657 - Financial Theft
T1578.002 - Create Cloud Instance

MITREへのリンク →

APT28

Score: 7.28

Matched TTPs:

T1199 - Trusted Relationship
T1498 - Network Denial of Service

MITREへのリンク →

APT29

Score: 5.27

Matched TTPs:

T1199 - Trusted Relationship
T1566.003 - Spearphishing via Service

MITREへのリンク →

Mustang Panda

Score: 4.13

Matched TTPs:

T1027.007 - Dynamic API Resolution

MITREへのリンク →

Lazarus Group

Score: 6.66

Matched TTPs:

T1027.007 - Dynamic API Resolution
T1566.003 - Spearphishing via Service

MITREへのリンク →

Axiom

Score: 4.54

Matched TTPs:

T1001.002 - Steganography

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Contagious Interview

Score: 0.78

Matched TTPs:

T1497 - Virtualization/Sandbox Evasion
T1566.003 - Spearphishing via Service
T1657 - Financial Theft
T1681 - Search Threat Vendor Data

MITREへのリンク →

Sandworm Team

Score: 0.71

Matched TTPs:

T1591.002 - Business Relationships
T1491.002 - External Defacement
T1199 - Trusted Relationship

MITREへのリンク →

LAPSUS$

Score: 0.69

Matched TTPs:

T1578.002 - Create Cloud Instance
T1591.002 - Business Relationships
T1199 - Trusted Relationship

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る