APT34 (OilRig): Espionage on Your Infrastructure

Post 5 of 5. APT34 is Iran's most technically mature espionage operation. A decade of refinement turned it into a group that barely needs malware: it takes your credentials, your Exchange server, and more patience than your defenders have.

KELA’s Cyber Intelligence Center (CIC) is a dedicated team of expert threat intelligence analysts who conduct deep investigations and analysis to support clients with customized, actionable intelligence. The CIC empowers KELA customers with high-value insights derived from dark web monitoring, cybercriminal communities, and exclusive intelligence sources.

Lewis Henderson is a cyber security veteran with over 26 years of experience protecting Government, CNI, and heavily regulated sectors such as Banking & Finance. A specialist in External Cyber Threat Intelligence, Exposure Management and Third Party Digital Risks, Lewis focuses on enabling organizations achieve operational maturity. By bridging the gap between technical telemetry and executive strategy, he empowers security teams to evolve from reactive responders into proactive, intelligence-driven defenders from nation-state and criminal cyber threats.

Published July 22, 2026

In late 2024, APT34 slipped a single malicious DLL onto a victim's domain controller. From then on, every time someone changed their password, the new one was captured in plaintext surrendered by the organization's own authentication system. The stolen data left as routine email, routed through the victim's own Exchange server. Almost none of it looked like an attack.

If you read Post 4, the contrast closes the loop. Prince of Persia is the actor that refuses to die; APT34 is the one that needs no reframing to threaten a US enterprise. It has already breached a US government contractor, pairs long-dwell espionage with genuinely destructive wipers, and has spent recent years learning to run an entire intrusion on the tools and credentials already inside your network.

This post walks through APT34's tradecraft end to end, and why identity and your own infrastructure, not your perimeter, are where an intrusion like this is caught, or missed.

» Strengthen your cybersecurity with KELA's expertise

APT34 is a state- cyber espionage group active since at least 2014, strongly linked to Iran's Ministry of Intelligence and Security (MOIS) and operating as a cyber contractor advancing the regime's national-security, geopolitical, and economic objectives.

Where several Iranian clusters are defined by persistence over polish, APT34 is defined by both. It sits inside a broader contractor ecosystem with documented operational overlaps with the IRGC and with groups such as APT33 and APT39, and while its primary mission is long-term intelligence collection, it has engaged in destructive sabotage when that aligns with Iranian state objectives.

» Find out why your organization needs cyber threat intelligence

Middle East core, expanding to the U.S., Europe, and Asia.

The group primarily targets:

» Learn how leaked credentials differ from compromised accounts

Historically a Gulf-and-Israel problem targeting energy, government, finance, and telecommunications across Saudi Arabia, the UAE, Israel, Jordan, Iraq, and Bahrain APT34 has steadily globalized, with confirmed operations against U.S., European, and Asian entities.

Its most recent named activity in the KELA report, the Earth Simnavaz campaign of late 2024, exploited a Windows kernel flaw to plant a malicious password-filter DLL on a victim's Exchange server, harvested plaintext credentials the moment users changed them, and exfiltrated the results through legitimate email traffic.

For security leaders, the business impact is the kind that surfaces late, if at all. APT34 rarely arrives with malware—it logs in.

Stolen credentials, valid accounts, web shells on your Exchange server, and a password-filter DLL on a domain controller let it read mail, harvest credentials, and quietly exfiltrate data for months while the traffic reads as routine administration. Little of that is what an EDR is tuned to catch, so the cost is not a noisy incident but a prolonged, low-signal loss of sensitive data and a foothold that is hard to evict once the actor is operating as a legitimate user.

Two factors raise the ceiling:

The 2020 Westat breach already placed U.S. enterprises inside the target set, and APT34's doctrine is engineered to defeat the malware-centric defenses most of them still run.

» Here's everything you should know credential compromise

Emerging partly out of the Iran–Saudi Arabia rivalry, OilRig's early campaigns hit Saudi defense, financial, and technology targets, using the Helminth backdoor delivered through fake job offers and macro-laden "Clayslide" Excel documents.

The pattern set here trust built before payload delivered still defines the group.

APT34 was linked to destructive operations using wiper malware in the Shamoon v3 and ZeroCleare families against Middle Eastern critical infrastructure and energy targets, a reminder that espionage and sabotage live on the same toolbench.

Then, in March 2019, the pseudonymous "Lab Dookhtegan" leak dumped a large cache of OilRig tooling (including PoisonFrog and Glimpse) and victim data.

The exposure briefly stalled operations.

The instructive part is what happened : the group retooled and upgraded its arsenal rather than disbanding, and resumed.

After the assassination of Qasem Soleimani and tightening sanctions, APT34 widened its aperture beyond the region.

It targeted Westat, a U.S. government contractor, using updated Tonedeaf and ValueVault malware to harvest credentials, while the parallel Fox Kitten activity exploited unpatched VPNs to reach global infrastructure.

This is the inflection point U.S. defenders should anchor on the moment OilRig stopped being someone else's problem.

The most recent named campaigns show the group's current doctrine.

In the Crambus intrusion (2023), an eight-month operation against Middle Eastern government entities, APT34 deployed PowerExchange, a PowerShell backdoor that watched a compromised Exchange server's inbox to receive commands and exfiltrate data as email.

In a 2024 breach of high-profile Iraqi government offices, it fielded the Veaty and Spearal families using passive IIS backdoors and DNS tunneling.

In late 2024, the Earth Simnavaz campaign against the Middle Eastern energy sector chained CVE-2024-30088, a Windows kernel elevation-of-privilege flaw, with a malicious password-filter DLL to lift plaintext credentials from Exchange and quietly mail them out.

Across all three, the through line is the same: less custom malware, more abuse of what is already in the environment.

Three characteristics define how APT34 operates today, and together they explain why it is so hard to detect.

The implication for defenders is unambiguous: Hunting for malware will not reliably surface this actor. Identity resilience and zero-trust segmentation will.

APT34's tradecraft is best understood in five stages, with inline MITRE ATT&CK technique IDs hyperlinked to their canonical pages and the full mapping in the appendix.

» Here are the most targeted entry points by hackers

The group invests in reconnaissance before ( T1590 ) and relies on three entry routes.

Where direct access is hard, APT34 reaches its target through supply-chain compromise ( T1195 ), abusing the trusted access of IT service and telecommunications providers to pivot into downstream enterprises. The group also maintains entry through external remote services ( T1133 ).

» Learn how to prevent phishing attacks before they catch you

Once inside, APT34 leans heavily on native scripting to stay fileless: PowerShell ( T1059.001 ), VBScript ( T1059.005 ), and the Windows command shell ( T1059.003 ) drive in-memory payloads that leave little on disk, typically after a user is induced to open a weaponized file ( T1204.002 ).

For privilege escalation it is willing to burn exploits when the prize justifies it; the Earth Simnavaz campaign used CVE-2024-30088 to reach SYSTEM ( T1068 ).

This is where OilRig's identity-centric doctrine becomes most visible. After initial compromise it plants custom IIS web shells TwoFace, RGDoor, and HighShell for lightweight, persistent access ( T1505.003 ). On domain controllers it registers a malicious password-filter DLL such as psgfilter.dll ( T1556.002 ), which captures every user password in plaintext at the moment it is changed a persistence and credential-harvesting mechanism in one.

The group schedules tasks to re-run its backdoors ( T1053.005 ), abuses the Outlook Page feature for Exchange-resident persistence ( T1137.004 ), and, above all, operates as valid users with stolen domain credentials ( T1078.002 ), which is what makes it so difficult to separate from legitimate activity. Evasion is correspondingly low-noise: masquerading binaries to match legitimate names and locations ( T1036.005 ), modifying or disabling host firewalls to clear tunnel paths ( T1562.004 ), and deleting indicators on disk ( T1070.004 ).

Credential theft is the engine of lateral movement. APT34 dumps OS credentials with tooling such as Mimikatz ( T1003 ), runs custom browser stealers CDumper, EDumper, PICKPOCKET, and ValueVault against saved passwords and session cookies in Chrome and Edge ( T1555.003 ) and against the Windows Credential Manager ( T1555.004 ), captures keystrokes where needed ( T1056.001 ), and will fall back to password spraying when it lacks a foothold ( T1110.003 ). Combined with the password-filter DLL, the result is an actor that rarely needs to break in twice.

APT34's C2 is engineered to look like ordinary traffic. The group is a long-standing practitioner of DNS tunneling ISMAgent, Saitama, and DNSpionage hide instructions inside benign-looking DNS queries and TXT records ( T1071 ). More distinctively, its advanced backdoors (PowerExchange, Veaty, STEALHOOK) sit directly on Microsoft Exchange and use the Exchange Web Services API to receive commands and exfiltrate stolen data as email attachments , blending into normal corporate mail flow.

To move tooling in and out it relies on ingress tool transfer ( T1105 ) and, to bypass firewalls, on legitimate remote-administration utilities notably ngrok and PuTTY Link (Plink) to stand up quiet tunnels back to its infrastructure. Bulk theft is staged over web services ( T1567 ) or alternative protocols ( T1048.002 ).

APT34's geographic core remains the Middle East, with heavy targeting of Saudi Arabia, Israel, the UAE, Jordan, Iraq, and Bahrain.

The trajectory, however, is outward. The group has expanded into Europe, the United States, and Asia, and the 2020 Westat and Fox Kitten activity confirms U.S. enterprises are inside the target set, not adjacent to it.

Two of those categories deserve specific attention from U.S. security leaders.

A U.S. enterprise with no obvious Iran nexus can still be reached through a managed service provider that does.

APT34's current doctrine is built to defeat malware-centric defense. Stolen credentials, valid accounts, a password-filter DLL on a domain controller, and native tooling generate little of what an EDR is tuned to catch.

The countermeasures are identity first:

Detection content for these behaviors is maintained in the [CIC repo] .

OilRig's most distinctive capability is turning your own Exchange server into a C2 and exfiltration channel via the EWS API, while using DNS tunneling ( T1071 ) as a covert backchannel.

Starter hunt queries are linked in the [CIC repo] .

Because APT34 reaches enterprises through trusted providers ( T1195) , perimeter hardening alone is insufficient.

Organizations should:

Assume that a provider compromise is a viable path to you, and design detections accordingly.

This is the final post of a series of five on Iran's APTs and the US Enterprise in 2026. To read other threat actor based content, please visit our blog page that is constantly updated here