Renowned for cyber espionage activities targeting critical sectors in the Middle East, OilRig, also known as APT34 or Helix Kitten operates with precision, exploiting vulnerabilities and employing advanced techniques to... The post CVE-2024-30088 Under Attack: OilRig Targets Windows Kernel Vulnerability appeared first on Cybersecurity News.

Earth Simnavaz, also known as APT34, is launching cyberattacks against UAE infrastructure by exploiting CVE-2024-30088. Learn about their tactics and tools, including RunPE-In-Memory.

ESET published research on the Iranian APT "BladedFeline," which researchers believe is a subgroup of the cyber-espionage entity APT34.

The Iranian state-sponsored hacking group APT34, aka OilRig, has recently escalated its activities with new campaigns targeting government and critical infrastructure entities in the United Arab Emira...

OilRig exploits a Windows kernel flaw in a cyber espionage campaign targeting UAE networks, leveraging backdoors and privilege escalation.

Iranian state-sponsored hackers conducted an eight-month espionage campaign against a Middle Eastern government, compromising dozens of computers. The Crambus group

The report from researchers at ESET is the latest insight into malicious code used by a group known as OilRig or APT34.

Sécurité : Turla APT a piraté le groupe iranien APT34 et a utilisé ses serveurs C&C pour infecter à nouveau les victimes d'APT34 avec ses propres logiciels malveillants.

Sécurité : Turla APT a piraté le groupe iranien APT34 et a utilisé ses serveurs C&C pour infecter à nouveau les victimes d'APT34 avec ses propres logiciels malveillants.

Sécurité : Turla APT a piraté le groupe iranien APT34 et a utilisé ses serveurs C&C pour infecter à nouveau les victimes d'APT34 avec ses propres logiciels malveillants.

Sécurité : Turla APT a piraté le groupe iranien APT34 et a utilisé ses serveurs C&C pour infecter à nouveau les victimes d'APT34 avec ses propres logiciels malveillants.

Kaspersky detailed Project CAV3RN, a modular cyberespionage framework targeting Israel that now uses AzureCommunication.dll and Microsoft Graph Outlook calendar events for C2. When Graph authentication fails, the module can recover TenantId, ClientId, ClientSecret, and UserEmail through DNS AAAA queries against cloudlanecdn[.]com, a capability that reinforces the report’s low-confidence attribution to OilRig (APT34). #ProjectCAV3RN #AzureCommunication.dll #cloudlanecdn.com #OilRig #APT34

The article analyzes DNS and WHOIS footprints tied to eight Iran-affiliated APT groups, uncovering extensive infrastructure, historical resolutions, and additional artifacts linked to their domains, IPs, and email records. It highlights coordinated impersonation campaigns, maliciously registered domains, and persistent activity across groups such as APT42, APT34, Pioneer Kitten, MuddyWater, and Void Manticore. #APT42 #APT34 #PioneerKitten #MuddyWater #VoidManticore #CyberAv3ngers #BladedFeline #PeachSandstorm #IranAPT

Hunt Intelligence uncovered an exposed staging server in the UAE that revealed a large intrusion campaign against Oman’s Ministry of Justice and Legal Affairs, including attacker tools, C2 code, session logs, and stolen data. The operation exfiltrated more than 26,000 user records and sensitive judicial information, with tactics overlapping known Iranian...

Coordinated kinetic escalation on February 28, 2026 has intensified a regional cyber threat environment in which Iranian state-sponsored groups and allied regional actors have a documented history of pre-positioning inside Western defense, finance, and technology networks. CloudSEK's research found over 100 exposed credential sets and 80+ publicly accessible MLOps deployments that permit unauthenticated access to training data, models, and cloud storage credentials, highlighting an urgent need to secure MLOps infrastructure #MLOps #APT34

Medical device maker Stryker disclosed a global cyber incident that wiped employee devices and locked about 5,500 staff out of company systems across Ireland, the US, Australia and India, disrupting its Microsoft environment and prompting external cybersecurity teams to contain the threat. The company says no ransomware or malware was confirmed,...

A joint report from the NCSC and NSA highlighting Turla activity

A well-known Iranian state-sponsored hacking group called OilRig, also tracked as APT34 and Helix Kitten, has been found hiding its command-and-control (C2) server configuration inside a regular-looking image file stored on Google Drive. The threat group used a technique called LSB (Least Significant Bit) steganography to quietly embed encrypted data into a PNG image, making the attack very hard to detect through standard security tools. OilRig is a cyberespionage group that has been active since at least 2016 and is widely believed to be linked to Iranian intelligence agencies. The group has a long history of targeting organizations across the Middle East, the United States, Europe, and parts of Asia, with a focus on government agencies, financial institutions, energy companies, telecom providers, and chemical firms. Its primary goal is to steal sensitive political, military, and geostrategic information from high-value targets. Analysts at the 360 Advanced Threat Research Institute identified multiple attack samples tied to this group during routine APT threat hunting operations. These findings exposed a new and more advanced attack chain that combined phishing emails, cloud service abuse, image steganography, and in-memory execution to build a covert multi-stage campaign. The group used the theme of Iran’s nationwide social protests to design convincing phishing documents that pushed victims into triggering the infection without knowing. The campaign started with a malicious Excel file titled “Final List_Tehran.xlsm,” crafted to appear as a legitimate document tied to social unrest in Iran. Attack Flow (Source – 360) The file referenced January 1404 of the Iranian calendar, corresponding to late December 2025 through January 2026, suggesting the attackers designed the bait around real-world events to increase its credibility. Once a victim opened the document and enabled macros, the full infection chain silently began executing in the background. The overall attack linked GitHub, Google Drive, and Telegram together into a seamless pipeline for payload delivery, configuration retrieval, and ongoing command communication. By routing malicious activity through trusted and widely used platforms, OilRig made it much harder for security tools to flag the traffic as suspicious. Inside the LSB Steganography Attack Chain The infection mechanism in this campaign was carefully built to avoid triggering security alerts at every step. When the victim enabled macros in the Excel file, the embedded VBA code silently decoded C# source code stored in the document’s CustomXMLParts section, then used the legitimate Windows compiler csc.exe to build a working malicious loader on the victim’s machine, which was saved as AppVStreamingUX_Multi_User.dll. The loader then connected to a GitHub repository under the account “johnpeterson1304” and pulled a text file named “tamiManager.txt.” After decoding its Base64 content, the loader received a Google Drive link pointing to an image named “MIO9.png”. OilRig Steganographic PNG (Source – 360) This image appeared completely normal but secretly carried encrypted C2 configuration data embedded within its least significant pixel bits. Using a custom LSB extraction algorithm followed by Base64 plus XOR decryption, the loader retrieved the full C2 setup, which contained a Telegram Bot token, a chat ID, and five module download addresses labeled m1 through m5. These modules handled persistence (pr), file upload (up), file download (do), command execution (cm), and application launch (runApp), and each one was loaded directly into memory to avoid leaving files on disk that security tools could scan. To maintain access after a reboot, OilRig used Windows scheduled tasks to keep the malware running persistently on the compromised machine, and the malware sent an “is online” heartbeat message through the Telegram Bot API every time it activated, giving the attacker real-time confirmation that the system remained under their control. Security teams should disable macro execution in Office files received from untrusted sources and set up network monitoring rules to catch unusual outbound traffic directed at GitHub or Google Drive. Organizations are also strongly advised to deploy endpoint detection solutions capable of identifying in-memory DLL loading, DLL side-loading , and process injection activity, all of which were key components of the attack technique used throughout this campaign. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post OilRig Hides C2 Configuration in Google Drive Image Using LSB Steganography appeared first on Cyber Security News .