OilRig is an Iranian state-sponsored cyber espionage group that’s been active for over a decade. While these Masked Actors operate independently, there may be overlaps with other Iranian APT groups. Attacks often begin with spearheaded phishing emails, typically disguised as personalized job applications or business documents. OilRig’s operations are increasingly sophisticated, frequently exploiting vulnerabilities to gain access to intelligence.
This group’s cybercrime campaigns have affected numerous organizations across the Middle East and occasionally beyond. They target a range of sectors, including finance, energy, telecommunications, chemical, and government.
No known identities. However, we believe the group operates under Iran’s Ministry of Intelligence and Security (MOIS) — suggesting members are Iranian nationals.
