Iranian Hackers Target Iraqi Gov: A Comedy of Cyber Errors

Iranian cyber group OilRig targets Iraqi government networks in a sophisticated attack, deploying new malware families Veaty and Spearal. The campaign uses custom DNS tunneling and email-based C2 channels through compromised accounts, showcasing OilRig’s evolving tactics.

Hot Take:

When diplomatic talks fail, just send in the malware! OilRig seems to think hacking is the best way to RSVP to Iraq’s state functions.

Key Points:

  • Iraqi government networks targeted by Iran’s OilRig group.
  • Spread through deceptive files like “Avamer.pdf.exe” and “IraqiDoc.docx.rar”.
  • New malware families Veaty and Spearal used, employing PowerShell commands and file harvesting.
  • Unique command-and-control (C2) mechanisms like DNS tunneling and email-based C2 channels.
  • OilRig’s tactics, techniques, and procedures (TTPs) remain consistent with past operations.

Membership Required

 You must be a member to access this content.

View Membership Levels
Already a member? Log in here