Source code of tools used by OilRig APT leaked on Telegram

Lab Dookhtegan hackers leaked details about operations carried out by Iran-linked OilRig group, including source code of 6 tools.

A hacker group that goes online with the name Lab Dookhtegan have disclosed details about operations conducted by the Iran-linked cyber-espionage group tracked as OilRig, APT34, and HelixKitten.

OilRig is an Iran-linked APT group that has been around since at least 2014, it targeted mainly organizations in the financial, government, energy, telecoms and chemical sectors in the United States and Middle Eastern countries.

The Lab Dookhtegan hackers used a Telegram channel to dump information about the OilRig infrastructure, revealing details about its hacking tools, members, and operations. The hackers also disclosed IP addresses and domains involved in operations conducted by the group over the years.

It seems that the tools have been leaked since mid-March on a Telegram channel by a user with the Lab Dookhtegan pseudonym.

The dump also includes OilRig victims’ data, including login credentials to several services obtained through phishing attacks.

The entity that leaked the information aimed at disrupting the operations of the Iran-linked hacking groups, it is likely an opponent of the Regime.

Lab Dookhtegan leaked the source code of the following six hacking tools, including data related on their contained in the compromised admin panels:

• Glimpse (aka BondUpdater), the latest version of the PowerShell-based trojan;
• PoisonFrog, an older version of BondUpdater;
• HyperShell web shell (aka TwoFace);
• HighShell web shell;
• Fox Panel phishing tool;
• Webmask, the main tool behind DNSpionage;

According to Chronicle, Dookhtegan leaked data from 66 victims in private industry and Government organizations, most from the Middle East, Africa, East Asia, and Europe.

The list of victims includes Etihad Airways and Emirates National Oil, hackers hit individuals in many industries including energy, transportation, and financial.

Lab Dookhtegan also doxxed Iranian Ministry of Intelligence officers, the leaked shared phone numbers, images, social media profiles, and names of officers involved with APT34 operations.

“We have more secret information about the crimes of the Iranian Ministry of Intelligence and its managers and we are determined to continue to expose them,” Dookhtegan said in a Telegram.

No doubt, the leak will have a severe impact on the future operations of the OilRig group.

Pierluigi Paganini

(SecurityAffairs – hacking, OilRig)

[adrotate banner=”5″]

[adrotate banner=”13″]

Share On