{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "apt34",
    "slug": "apt34",
    "name": "APT34",
    "shortName": "APT34",
    "country": "Iran",
    "countryCode": "IR",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2014",
    "prominence": 84,
    "mitreGroupId": "G0049",
    "malpediaSlug": "oilrig",
    "tagline": "MOIS operation against Gulf energy and government. Had its source code and operator identities leaked on Telegram — then kept operating.",
    "bio": "APT34, widely known as OilRig, conducts long-duration espionage against government, energy, telecommunications, and financial targets across the Middle East, with a persistent focus on the Gulf states and on organisations connected to regional energy infrastructure.\n\nIts technical signature is DNS tunnelling. The group encodes command and control inside DNS queries and responses — a protocol that must be permitted outbound in essentially every network, is rarely inspected, and often bypasses proxies and TLS interception entirely. Its DNS implants have been refined across many generations.\n\nThe group is also notable for two extraordinary reversals of fortune. In 2019 a persona called Lab Dookhtegan published its source code, operator handles, C2 server details, and victim credentials on Telegram — an apparent insider leak that exposed the operation from the inside. Separately, and unusually, APT34 has been on the receiving end of another state's tradecraft: in October 2019 the UK NCSC and NSA jointly disclosed that Russia's Turla had compromised OilRig's infrastructure and implants, and was running its own operations through them so that victims would attribute the activity to Iran.\n\nNeither event stopped it. The group rebuilt and continues to operate, with recent campaigns using Microsoft Exchange servers as C2 channels — exfiltrating stolen data as email through the victim's own mail infrastructure.",
    "attribution": {
      "sponsor": "Iran",
      "service": "MOIS — Ministry of Intelligence and Security",
      "confidence": "high",
      "summary": "Assessed as operating on behalf of Iran's Ministry of Intelligence and Security, based on FireEye/Mandiant analysis of infrastructure and operator artifacts, the 2019 Lab Dookhtegan leak of internal tooling and operator identities, and consistent industry reporting. Targeting aligns closely with Iranian strategic interests in the Gulf. No individuals have been indicted specifically for APT34 operations.",
      "sources": [
        {
          "org": "Mandiant / FireEye",
          "title": "APT34: New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/targeted-attack-in-middle-east-by-apt34",
          "date": "2017-12-07"
        },
        {
          "org": "NCSC-UK / NSA",
          "title": "Turla group exploits Iranian APT to expand coverage of victims",
          "url": "https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims",
          "date": "2019-10-21"
        }
      ]
    },
    "motivations": [
      "espionage"
    ],
    "targetSectors": [
      "Government",
      "Energy",
      "Oil & Gas",
      "ICS / SCADA",
      "Financial Services",
      "Telecommunications",
      "Chemical",
      "Aerospace",
      "Defense",
      "Technology"
    ],
    "targetCountries": [
      "Saudi Arabia",
      "United Arab Emirates",
      "Kuwait",
      "Qatar",
      "Israel",
      "Jordan",
      "Lebanon",
      "United States",
      "United Kingdom",
      "Albania"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "OilRig",
        "url": "https://attack.mitre.org/groups/G0049/",
        "correlation": "exact"
      },
      {
        "org": "microsoft",
        "name": "Hazel Sandstorm",
        "correlation": "exact",
        "note": "Formerly EUROPIUM"
      },
      {
        "org": "microsoft",
        "name": "EUROPIUM",
        "correlation": "exact",
        "note": "Retired designator"
      },
      {
        "org": "crowdstrike",
        "name": "Helix Kitten",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "APT34",
        "correlation": "exact"
      },
      {
        "org": "secureworks",
        "name": "COBALT GYPSY",
        "correlation": "exact"
      },
      {
        "org": "unit42",
        "name": "Evasive Serpens",
        "correlation": "exact"
      },
      {
        "org": "trendmicro",
        "name": "Earth Simnavaz",
        "correlation": "exact"
      },
      {
        "org": "eset",
        "name": "OilRig",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "OilRig",
        "correlation": "exact"
      },
      {
        "org": "kaspersky",
        "name": "Chrysene",
        "correlation": "partial",
        "note": "Dragos designator for an overlapping ICS-adjacent cluster"
      },
      {
        "org": "dragos",
        "name": "CHRYSENE",
        "correlation": "partial",
        "note": "Dragos tracks the industrial-adjacent element of this activity"
      }
    ],
    "tools": [
      {
        "name": "DNSExfiltrator / DNS tunnelling implants",
        "type": "backdoor",
        "custom": true,
        "description": "Signature capability — C2 encoded inside DNS queries and responses, traversing networks where all other outbound protocols are inspected."
      },
      {
        "name": "POWRUNER / BONDUPDATER",
        "type": "backdoor",
        "custom": true,
        "description": "PowerShell backdoors with DNS-based C2 and staged plugin loading.",
        "malpediaSlug": "ps1.bondupdater"
      },
      {
        "name": "Karkoff",
        "type": "backdoor",
        "custom": true,
        "description": "Selective backdoor that fingerprints the host and executes only on intended targets."
      },
      {
        "name": "SideTwist",
        "type": "backdoor",
        "custom": true,
        "description": "C-based backdoor delivered via job-themed lure documents."
      },
      {
        "name": "Exchange as C2",
        "type": "utility",
        "custom": true,
        "description": "Exfiltration routed as email through the victim's own Exchange server, so stolen data leaves as ordinary mail traffic."
      },
      {
        "name": "Web shells (RGDoor)",
        "type": "utility",
        "custom": true,
        "description": "IIS backdoor providing a passive fallback channel when primary access is lost.",
        "malpediaSlug": "win.rgdoor"
      },
      {
        "name": "Mimikatz variants",
        "type": "lotl",
        "custom": false,
        "description": "Credential dumping using recompiled variants to evade signature detection."
      }
    ],
    "techniques": [
      {
        "tCode": "T1071.004",
        "name": "Application Layer Protocol: DNS",
        "tactic": "Command and Control",
        "note": "The group's defining technique — DNS tunnelling across many implant generations"
      },
      {
        "tCode": "T1566.001",
        "name": "Phishing: Spearphishing Attachment",
        "tactic": "Initial Access",
        "note": "Job-offer and CV-themed lures aimed at energy and government staff"
      },
      {
        "tCode": "T1190",
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access"
      },
      {
        "tCode": "T1505.003",
        "name": "Server Software Component: Web Shell",
        "tactic": "Persistence",
        "note": "RGDoor IIS backdoor as passive fallback"
      },
      {
        "tCode": "T1078",
        "name": "Valid Accounts",
        "tactic": "Persistence"
      },
      {
        "tCode": "T1556.002",
        "name": "Modify Authentication Process: Password Filter DLL",
        "tactic": "Credential Access",
        "note": "Capturing plaintext passwords at change time on domain controllers"
      },
      {
        "tCode": "T1003.001",
        "name": "OS Credential Dumping: LSASS Memory",
        "tactic": "Credential Access"
      },
      {
        "tCode": "T1048",
        "name": "Exfiltration Over Alternative Protocol",
        "tactic": "Exfiltration",
        "note": "Data exfiltrated as email through the victim's own Exchange server"
      },
      {
        "tCode": "T1090.001",
        "name": "Proxy: Internal Proxy",
        "tactic": "Command and Control"
      },
      {
        "tCode": "T1074.001",
        "name": "Data Staged: Local Data Staging",
        "tactic": "Collection"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2017-11882",
        "firstExploited": "2017-12-01",
        "usage": "Equation Editor overflow embedded in lure documents delivering POWRUNER against Middle East government targets.",
        "source": {
          "org": "Mandiant / FireEye",
          "title": "New Targeted Attack in the Middle East by APT34",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/targeted-attack-in-middle-east-by-apt34",
          "date": "2017-12-07"
        }
      },
      {
        "cveId": "CVE-2021-26855",
        "firstExploited": "2021-05-01",
        "usage": "ProxyLogon exploited for Exchange access, aligning with the group's later use of Exchange as an exfiltration channel.",
        "source": {
          "org": "ESET",
          "title": "Exchange servers under siege from at least 10 APT groups",
          "url": "https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/",
          "date": "2021-03-10"
        }
      },
      {
        "cveId": "CVE-2020-0688",
        "firstExploited": "2020-06-01",
        "usage": "Exchange validation key flaw exploited for SYSTEM-level code execution on mail servers.",
        "source": {
          "org": "Microsoft Threat Intelligence",
          "title": "Iranian threat actor exploiting Exchange vulnerabilities",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/",
          "date": "2022-09-08"
        }
      },
      {
        "cveId": "CVE-2022-47966",
        "firstExploited": "2023-01-01",
        "usage": "Zoho ManageEngine unauthenticated RCE exploited against government targets in the region.",
        "source": {
          "org": "Unit 42",
          "title": "Iranian threat actors exploiting ManageEngine vulnerabilities",
          "url": "https://unit42.paloaltonetworks.com/manageengine-cve-2022-47966/",
          "date": "2023-02-02"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "turla",
        "type": "operational-overlap",
        "confidence": "high",
        "note": "Turla compromised OilRig's infrastructure and implants and ran operations through them under Iranian cover — jointly disclosed by NCSC-UK and NSA in 2019."
      },
      {
        "relatedActorId": "muddywater",
        "type": "same-sponsor",
        "confidence": "high",
        "note": "Both MOIS-linked with overlapping regional targeting and occasional shared infrastructure."
      },
      {
        "relatedActorId": "apt33",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both Iranian state-nexus against energy targets; different services and distinct toolsets."
      }
    ],
    "reports": [
      {
        "org": "Mandiant / FireEye",
        "title": "New Targeted Attack in the Middle East by APT34",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/targeted-attack-in-middle-east-by-apt34",
        "date": "2017-12-07"
      },
      {
        "org": "NCSC-UK / NSA",
        "title": "Turla group exploits Iranian APT to expand coverage of victims",
        "url": "https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims",
        "date": "2019-10-21"
      },
      {
        "org": "Trend Micro",
        "title": "Earth Simnavaz Levies Advanced Cyberattacks Against UAE and Gulf Regions",
        "url": "https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks-uae-gulf-regions.html",
        "date": "2024-10-11"
      },
      {
        "org": "ESET",
        "title": "OilRig's outstanding tools: Downloaders using cloud services",
        "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/",
        "date": "2023-09-21"
      }
    ],
    "campaigns": [
      {
        "id": "oilrig-leak",
        "actorId": "apt34",
        "name": "Lab Dookhtegan Source Code Leak",
        "date": "2019-03-26",
        "significance": "notable",
        "targetSectors": [
          "Government",
          "Energy",
          "Financial Services",
          "Telecommunications"
        ],
        "targetCountries": [
          "Iran",
          "Saudi Arabia",
          "United Arab Emirates"
        ],
        "cveIds": [],
        "summary": "A persona calling itself Lab Dookhtegan published OilRig's source code, operator handles, C2 server details, and victim credentials on Telegram — an apparent insider leak exposing an active state operation from the inside. The group rebuilt and resumed operations.",
        "sources": [
          {
            "org": "Unit 42",
            "title": "Behind the Scenes with OilRig",
            "url": "https://unit42.paloaltonetworks.com/behind-the-scenes-with-oilrig/",
            "date": "2019-04-24"
          }
        ]
      }
    ],
    "flag": "🇮🇷",
    "profile": "/apt/apt34/"
  }
}