An Iranian nation-state hacker dubbed OilRig is being further analyzed for two (2) different campaigns they carried out in 2021 and 2022 targeted at Israeli organizations. OilRig has been assigned a multitude of names by different security researchers, all of whom affiliate themselves with Iran’s Ministry of Intelligence and Security (MOIS). The threat actor has been active since 2014, known to use a wide range of tools to perform information theft attacks, primarily targeting telecommunications, government, defense, oil and financial services verticals in the Middle East. The two (2) campaigns against Israeli organizations, called Outer Space and Juicy Mix, used two (2) previously documented first-stage backdoors (“Solar” and “Mango”) to siphon out sensitive information from major browsers and the Windows Credential Manager. Researchers have observed the group’s unique ability to use simple back doors to steal users’ credentials while also having the flexibility to write new malware by researching the customer environments and levels of access. They are notable for their adaptability, being seen continuously innovating to create new implants with backdoor capabilities and finding new ways to execute commands on remote systems. Their deployment of custom post-compromise tools to collect credentials, cookies, and browsing history is also notable. Researchers’ latest findings show the group’s continued focus on Israel, using spear-phishing methods to trick potential targets into installing malware via booby-trapped attachments. There have also been cases where the threat actor has delivered updated versions of “SideTwist”, a variant of a backdoor capable of file download/upload and command execution, as part of phishing attacks targeting US businesses. CTIX analysts will continue to monitor Iranian threat group activity and provide details of new campaigns are they are disclosed.