The Iranian state-sponsored hacking group OilRig, also known as APT34 or Earth Simnavaz, has escalated its cyber espionage activities, targeting government and critical infrastructure in the UAE and the broader Gulf region. Recent campaigns involve exploiting a now-patched Windows Kernel vulnerability, tracked as CVE-2024-30088, which allows attackers to gain SYSTEM-level privileges. OilRig uses this vulnerability in conjunction with a new backdoor called StealHook, designed to steal credentials through compromised Microsoft Exchange servers and exfiltrate data via legitimate email traffic. The attack chain begins with the exploitation of vulnerable web servers to deploy web shells, enabling remote execution of code and PowerShell commands. The group then uses tools like ngrok for stealthy communications and a password filter DLL (psgfilter.dll) to extract plaintext credentials from domain users. These tactics are part of a broader strategy to maintain persistence in compromised networks and leverage government infrastructure to obfuscate malicious activity. OilRig’s link to another Iranian APT group, FOX Kitten, raises concerns about the potential for ransomware attacks, especially given their focus on critical energy sectors in the region, where operational disruptions could have severe impacts. The group’s latest tactics suggest an evolution of previous campaigns, building on past malware like PowerExchange and Karkoff, but refining methods for credential theft and persistence in high-value targets. CTIX analysts recommend that all users make a concerted effort to ensure that their operating systems are always up-to-date with the latest patches to prevent exploitation of known vulnerabilities.