Iranian hackers which previously targeted organizations in Saudi Arabia are now targeting organizations in other countries, including the US, as part of a campaign identified as OilRig campaign.
In addition to expanding its reach, the group has been enhancing its malware tools.
Researchers at Palo Alto Networks have been monitoring the group for some time and have reported observing attacks launched by a threat actor against financial institutions and technology companies in Saudi Arabia and on the Saudi defense industry. This campaign referred to as “OilRig,” by Palo Alto Networks, entails weaponized Microsoft Excel spreadsheets tracked as “Clayslide” and a backdoor called “Helminth.”
Bank attacks by the Iran-linked group were analyzed and documented by FireEye in May. Security Week reports that Palo Alto Networks, “discovered that it has also targeted a company in Qatar and government organizations in the United States, Israel and Turkey.” Read More