#oilrig — Public Fediverse posts on home.social

OTX Bot @[email protected] · 2026-07-22 · 08:32 UTC

New Project CAV3RN .NET Native AOT communication module

Kaspersky identified a new .NET Native AOT communication module for Project CAV3RN, a sophisticated cyberespionage framework targeting Israel. This module replaces the previous HTTP/WebSocket component by exchanging commands through Outlook calendar events accessed via Microsoft Graph API. Commands and results are stored in a fixed time window (2050-05-13 22:00-23:00 UTC) using specific subject patterns to identify heartbeats, commands, and outputs. The module implements RSA and AES-GCM encryption for secure communications. If Microsoft Graph authentication fails, it retrieves replacement configuration settings through DNS AAAA record responses from actor-controlled nameservers. The infrastructure analysis and behavioral patterns suggest low-confidence attribution to OilRig (APT34), based on the use of Microsoft-hosted services for command and control and compromised regional infrastructure.

Pulse ID: 6a5f55d6d75eaa9d17122eea
Pulse Link: https://otx.alienvault.com/pulse/6a5f55d6d75eaa9d17122eea
Pulse Author: AlienVault
Created: 2026-07-21 11:19:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT34 #CyberSecurity #Cyberespionage #DNS #Encryption #Espionage #HTTP #InfoSec #Israel #Kaspersky #Microsoft #NET #OTX #OilRig #OpenThreatExchange #Outlook #RAT #Troll #bot #AlienVault

#apt34 #cybersecurity #cyberespionage #dns #encryption #espionage

OTX Bot @[email protected] · 2026-07-22 · 08:32 UTC

New Project CAV3RN .NET Native AOT communication module

Kaspersky identified a new .NET Native AOT communication module for Project CAV3RN, a sophisticated cyberespionage framework targeting Israel. This module replaces the previous HTTP/WebSocket component by exchanging commands through Outlook calendar events accessed via Microsoft Graph API. Commands and results are stored in a fixed time window (2050-05-13 22:00-23:00 UTC) using specific subject patterns to identify heartbeats, commands, and outputs. The module implements RSA and AES-GCM encryption for secure communications. If Microsoft Graph authentication fails, it retrieves replacement configuration settings through DNS AAAA record responses from actor-controlled nameservers. The infrastructure analysis and behavioral patterns suggest low-confidence attribution to OilRig (APT34), based on the use of Microsoft-hosted services for command and control and compromised regional infrastructure.

Pulse ID: 6a5f55d6d75eaa9d17122eea
Pulse Link: https://otx.alienvault.com/pulse/6a5f55d6d75eaa9d17122eea
Pulse Author: AlienVault
Created: 2026-07-21 11:19:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT34 #CyberSecurity #Cyberespionage #DNS #Encryption #Espionage #HTTP #InfoSec #Israel #Kaspersky #Microsoft #NET #OTX #OilRig #OpenThreatExchange #Outlook #RAT #Troll #bot #AlienVault

#apt34 #cybersecurity #cyberespionage #dns #encryption #espionage

Daily CyberSecurity @[email protected] · 2026-07-21 · 09:09 UTC

Kaspersky details Project CAV3RN, an OilRig-linked cyberespionage framework. Its new module hides C2 in Outlook calendar events, with DNS AAAA fallback.

#ProjectCAV3RN #OilRig #APT34 #Cyberespionage #Kaspersky #MicrosoftGraph #DNS

https://securityonline.info/project-cav3rn-outlook-calendar-c2/?utm_source=mastodon&utm_medium=jetpack_social

#projectcav3rn #oilrig #apt34 #cyberespionage #kaspersky #microsoftgraph

Daily CyberSecurity @[email protected] · 2026-07-21 · 09:09 UTC

Kaspersky details Project CAV3RN, an OilRig-linked cyberespionage framework. Its new module hides C2 in Outlook calendar events, with DNS AAAA fallback.

#ProjectCAV3RN #OilRig #APT34 #Cyberespionage #Kaspersky #MicrosoftGraph #DNS

https://securityonline.info/project-cav3rn-outlook-calendar-c2/?utm_source=mastodon&utm_medium=jetpack_social

#dns #microsoftgraph #kaspersky #cyberespionage #apt34 #oilrig

OTX Bot @[email protected] · 2026-07-07 · 14:35 UTC

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

Check Point Research tracks Cavern Manticore, an Iran-nexus threat actor targeting Israeli government and IT sectors. The actor deploys a modular C2 framework built on .NET but compiled into different formats including Mixed-Mode C++/CLI and Native AOT, creating significant anti-analysis challenges. The framework consists of core agents and specialized post-exploitation modules providing capabilities for file system operations, database browsing, LDAP querying, network reconnaissance, and tunneling. Initial access is achieved through abuse of Remote Monitoring and Management software like SysAid. The actor demonstrates supply-chain compromise tactics, using IT providers as stepping stones to reach higher-value targets. Technical overlaps link Cavern Manticore to Iranian MOIS-aligned groups including MuddyWater and Lyceum subgroup of OilRig.

Pulse ID: 6a4bb565cb9499639bf4125b
Pulse Link: https://otx.alienvault.com/pulse/6a4bb565cb9499639bf4125b
Pulse Author: AlienVault
Created: 2026-07-06 14:02:13

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CheckPoint #CyberSecurity #Government #ICS #InfoSec #Iran #Israel #MuddyWater #NET #OTX #OilRig #OpenThreatExchange #RAT #SysAid #bot #AlienVault

#checkpoint #cybersecurity #government #ics #infosec #iran

OTX Bot @[email protected] · 2026-07-07 · 14:35 UTC

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

Check Point Research tracks Cavern Manticore, an Iran-nexus threat actor targeting Israeli government and IT sectors. The actor deploys a modular C2 framework built on .NET but compiled into different formats including Mixed-Mode C++/CLI and Native AOT, creating significant anti-analysis challenges. The framework consists of core agents and specialized post-exploitation modules providing capabilities for file system operations, database browsing, LDAP querying, network reconnaissance, and tunneling. Initial access is achieved through abuse of Remote Monitoring and Management software like SysAid. The actor demonstrates supply-chain compromise tactics, using IT providers as stepping stones to reach higher-value targets. Technical overlaps link Cavern Manticore to Iranian MOIS-aligned groups including MuddyWater and Lyceum subgroup of OilRig.

Pulse ID: 6a4bb565cb9499639bf4125b
Pulse Link: https://otx.alienvault.com/pulse/6a4bb565cb9499639bf4125b
Pulse Author: AlienVault
Created: 2026-07-06 14:02:13

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CheckPoint #CyberSecurity #Government #ICS #InfoSec #Iran #Israel #MuddyWater #NET #OTX #OilRig #OpenThreatExchange #RAT #SysAid #bot #AlienVault