Individual skill
apt34-oilrig
Adversary-emulation profile for APT34 / OilRig (G0049), an Iranian state-sponsored espionage group, mapping its ATT&CK TTPs to Decepticon tooling for authorized red-team emulation.
packages/decepticon/decepticon/skills/shared/adversary-emulation/apt34-oilrig/SKILL.md
Source commit df879550544d36b6b1e69062f05adae28537adf2
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 6,568
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent Repository topic
- ai Repository topic
- cybersecurity Repository topic
- hacking Repository topic
- langchain Repository topic
- langgraph Repository topic
- llm Repository topic
- generative-ai Repository topic
- pentesting Repository topic
- pentest Repository topic
- engineering Derived category
Declared tags are partial or unavailable.
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# APT34 (OilRig, Helix Kitten, Hazel Sandstorm) — Adversary Emulation Profile
APT34 — tracked as OilRig, Helix Kitten, Hazel Sandstorm, Earth Simnavaz, Crambus, Cobalt Gypsy / COBALT GYPSY, IRN2, Evasive Serpens, EUROPIUM, ITG13, and TA452 (MITRE ATT&CK **G0049**) — is a suspected Iranian state-sponsored cyber-espionage group operational since at least 2014. It conducts long-running, reconnaissance-heavy intrusions against Middle Eastern and international organizations, favoring spearphishing for initial access, heavy use of PowerShell/VBScript backdoors, custom DNS-tunneling C2, supply-chain and trust-relationship abuse, and patient credential harvesting. The group continually re-tools (BONDUPDATER → SideTwist → cloud/Exchange-based C2) and is notable for living-off-the-land tradecraft, password-filter-DLL credential capture, and exfiltrating data through victim-owned Microsoft Exchange servers to blend with legitimate mail flow.
## Attribution & motivation
- **Suspected sponsor:** Iran. FireEye/Mandiant assesses APT34 "works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests." Multiple vendors (Trend Micro, Microsoft, CrowdStrike) link the cluster to Iranian intelligence services.
- **Motivation:** Strategic **cyber espionage** — long-term reconnaissance and credential/data theft to advance Iranian geopolitical interests in the region. Primary intent is intelligence collection, not financial gain. (A separate but related Iranian destructive operation, ZeroCleare wiper (S1151), is associated with the same cluster, indicating latent destructive capability.)
- **Confidence:** High that the activity is Iranian state-aligned espionage; the precise sponsoring agency varies by vendor naming. Attribution of any single intrusion should be treated as suspected unless backed by collected infrastructure/tooling overlap.
## Targeting
- **Sectors:** Financial/banking, government, energy/oil & gas, chemical, telecommunications, critical infrastructure, and aviation/transport.
- **Regions:** Primarily the Middle East — Gulf Cooperation Council states (UAE, Saudi Arabia, Kuwait, Qatar, Bahrain), plus Israel; with international reach into the U.S. and other regions via supply-chain and trust-relationship pivots.
- **Victim profile:** Government ministries and state-aligned enterprises in strategic sectors; the group frequently compromises one organization (e.g., HR/job portals, telecoms) and abuses that trust to reach higher-value government targets.
