OilRig Hides C2 Config in Google Drive Image via LSB Steganography

Gbhackers •Mayura Kathir • April 28, 2026

APT-C-49 (OilRig), an Iranian state- advanced persistent threat group also known as APT34 and Helix Kitten, has deployed a sophisticated new attack campaign that conceals command-and-control configurations inside Google Drive images using LSB steganography. The group, which has been active since at least 2014, primarily targets government, energy, telecommunications, and financial sectors across the Middle […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OilRig Uses LSB Steganography to Conceal C2 Configurations in Google Drive Images The Iranian APT group OilRig, also known as APT34 and Helix Kitten, has launched a new attack campaign utilizing LSB (Least Significant Bit) steganography to hide command-and-control (C2) configurations within PNG images stored on Google Drive. This sophisticated method allows the group to embed encrypted data within seemingly innocuous image files, making detection challenging. OilRig primarily targets sectors such as government, energy, telecommunications, and finance, indicating a broad potential impact across critical infrastructures. The group has been active since at least 2014, and this recent tactic highlights their evolving strategies in cyber operations. There are no specific CVEs or tools mentioned in the articles, but the use of steganography represents a significant advancement in their operational security. As of now, the full scope of the impact remains unclear, but the stealthy nature of the attack raises concerns among cybersecurity professionals. 2 sources 57

Extracted Entities

OilRig Hides C2 Config in Google Drive Image via LSB Steganography

The full story

Extracted Entities

APT Groups (4)

Attack Types (1)

Industries (4)

MITRE ATT&CK (1)

Tools (1)