Outer Space

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Outer Space was a campaign conducted by OilRig throughout 2021 that used the SampleCheck5000 downloader and Solar backdoor to target Israeli organizations.(Citation: ESET OilRig Campaigns Sep 2023)

This is a historical record and does not establish current campaign activity.

Threat actor

OilRig

Attribution confidence

Not established

First documented activity

2021-01-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2021-01-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2021-12-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1105 · Ingress Tool Transfer

  Command And Control — During Outer Space, OilRig downloaded additional tools to comrpomised infrastructure.(Citation: ESET OilRig Campaigns Sep 2023)

• T1584.004 · Server

  Resource Development — During Outer Space, OilRig compromised an Israeli human resources site to use as a C2 server.(Citation: ESET OilRig Campaigns Sep 2023)

• T1217 · Browser Information Discovery

  Discovery — During Outer Space, OilRig used a Chrome data dumper named MKG.(Citation: ESET OilRig Campaigns Sep 2023)

• T1071.001 · Web Protocols

  Command And Control — During Outer Space, OilRig used HTTP to communicate between installed backdoors and compromised servers including via the Microsoft Exchange Web Services API.(Citation: ESET OilRig Campaigns Sep 2023)

• T1585.003 · Cloud Accounts

  Resource Development — During Outer Space, OilRig created M365 email accounts to be used as part of C2.(Citation: ESET OilRig Campaigns Sep 2023)

• T1027.013 · Encrypted/Encoded File

  Stealth — During Outer Space, OilRig deployed VBS droppers with obfuscated strings.(Citation: ESET OilRig Campaigns Sep 2023)

• T1587.001 · Malware

  Resource Development — For Outer Space, OilRig created new implants including the Solar backdoor.(Citation: ESET OilRig Campaigns Sep 2023)

• T1059.005 · Visual Basic

  Execution — During Outer Space, OilRig used VBS droppers to deploy malware.(Citation: ESET OilRig Campaigns Sep 2023)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0042

  Official MITRE ATT&CK campaign record C0042. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.