OilRig
OilRig is an Iran-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 15 sectors, including Government and Technology, in 50 countries, including the United States and the United Kingdom. It uses 188 MITRE ATT&CK techniques and exploits 34 known CVEs.
Also known as
- COBALT GYPSY
- IRN2
- Helix Kitten
- Evasive Serpens
- Hazel Sandstorm
- EUROPIUM
- ITG13
- TA452
- Scarred Manticore
- APT34
- Origin
- Iran
- Techniques
- 188
- Exploited CVEs
- 34
- First seen
- Jan 1, 2014
- Last seen
- Dec 1, 2022
- Record updated
Who They Target.
Sectors · 15
Countries · 50
Labelsapt34espionagemena
About OilRig.
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications.
Last updated Jul 27, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.