Cybersecurity researchers have published reports showing that throughout 2022, OilRig (an Iranian state-sponsored threat actor also known as APT34, Crambus, Cobalt Gypsy, Hazel Sandstorm, and Helix Kitten) was observed deploying three (3) new downloader malware strains named ODAgent, OilCheck, and OilBooster, along with an updated version of a known downloader called SampleCheck5000 (SC5k), to maintain persistent access to victim organizations primarily in Israel. Active since 2014, OilRig Group mainly targets entities in the Middle East. The downloaders are notable for using legitimate cloud service APIs, like Microsoft Graph OneDrive, Outlook APIs, and Microsoft Office Exchange Web Services (EWS) API, for command-and-control (C2) and data exfiltration. This strategy aims to blend malicious activities with authentic network traffic, covering up the attack infrastructure. The targets of these attacks included entities in healthcare, manufacturing, and local government, many of which had been previously targeted by OilRig. Each downloader has unique characteristics. ODAgent, first detected in February 2022, is a C#/.NET downloader using the Microsoft OneDrive API for C2 communications. SampleCheck5000 interacts with a Microsoft Exchange mail account using the Office Exchange Web Services API. OilBooster, similar to ODAgent, uses the Microsoft OneDrive API, while OilCheck, like SampleCheck5000, uses Microsoft Graph API but for network communications. OilBooster and OilCheck also use the Microsoft Graph API to connect to a Microsoft Office 365 account, but they differ in their use of OneDrive and Outlook accounts for command retrieval and payload fetching.