Juicy Mix

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Juicy Mix was a campaign conducted by OilRig throughout 2022 that targeted Israeli organizations with the Mango backdoor.(Citation: ESET OilRig Campaigns Sep 2023)

This is a historical record and does not establish current campaign activity.

Threat actor

OilRig

Attribution confidence

Not established

First documented activity

2022-01-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2022-01-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2022-12-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During Juicy Mix, OilRig used a script to concatenate and deobfuscate encoded strings in Mango.(Citation: ESET OilRig Campaigns Sep 2023)

• T1217 · Browser Information Discovery

  Discovery — During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) data stealers to collect cookies, browsing history, and credentials.(Citation: ESET OilRig Campaigns Sep 2023)

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During Juicy Mix, OilRig used VBS droppers to schedule tasks for persistence.(Citation: ESET OilRig Campaigns Sep 2023)

• T1132.001 · Standard Encoding

  Command And Control — During Juicy Mix, OilRig used a VBS script to send the Base64-encoded name of the compromised computer to C2.(Citation: ESET OilRig Campaigns Sep 2023)

• T1518 · Software Discovery

  Discovery — During Juicy Mix, OilRig used browser data dumper tools to create a list of users with Google Chrome installed.(Citation: ESET OilRig Campaigns Sep 2023)

• T1071.001 · Web Protocols

  Command And Control — During Juicy Mix, OilRig used a VBS script to send POST requests to register installed malware with C2.(Citation: ESET OilRig Campaigns Sep 2023)

• T1059.001 · PowerShell

  Execution — During Juicy Mix, OilRig used a PowerShell script to steal credentials.(Citation: ESET OilRig Campaigns Sep 2023)

• T1074.001 · Local Data Staging

  Collection — During Juicy Mix, OilRig used browser data and credential stealer tools to stage stolen files named Cupdate, Eupdate, and IUpdate in the %TEMP% directory.(Citation: ESET OilRig Campaigns Sep 2023)

• T1082 · System Information Discovery

  Discovery — During Juicy Mix, OilRig used a script to send the name of the compromised host via HTTP `POST` to register it with C2.(Citation: ESET OilRig Campaigns Sep 2023)

• T1587.001 · Malware

  Resource Development — For Juicy Mix, OilRig improved on Solar by developing the Mango backdoor.(Citation: ESET OilRig Campaigns Sep 2023)

• T1555.004 · Windows Credential Manager

  Credential Access — During Juicy Mix, OilRig used a Windows Credential Manager stealer for credential access.(Citation: ESET OilRig Campaigns Sep 2023)

• T1059.005 · Visual Basic

  Execution — During Juicy Mix, OilRig used VBS droppers to deliver and establish persistence for the Mango backdoor.(Citation: ESET OilRig Campaigns Sep 2023)

• T1584.004 · Server

  Resource Development — During Juicy Mix, OilRig compromised an Israeli job portal to use for a C2 server.(Citation: ESET OilRig Campaigns Sep 2023)

• T1555.003 · Credentials from Web Browsers

  Credential Access — During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) to collect credentials.(Citation: ESET OilRig Campaigns Sep 2023)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0044

  Official MITRE ATT&CK campaign record C0044. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.