{"id":41158,"date":"2023-05-09T10:31:29","date_gmt":"2023-05-09T07:31:29","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=41158"},"modified":"2026-03-28T03:13:49","modified_gmt":"2026-03-28T00:13:49","slug":"kaspersky-experts-warn-of-increased-it-supply-chain-attacks-by-oilrig-apt-in-the-middle-east-and-turkiye","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-experts-warn-of-increased-it-supply-chain-attacks-by-oilrig-apt-in-the-middle-east-and-turkiye\/","title":{"rendered":"Kaspersky experts warn of increased IT supply chain attacks by OilRig APT in the Middle East and Turkiye"},"content":{"rendered":"\n

During the annual <\/strong>Cyber Security Weekend 2023<\/em><\/strong> for the Middle East, Turkiye and Africa which was recently held in Almaty, Kazakhstan Kaspersky researchers announced the discovery of a series of attacks by a new malware supposedly developed by the infamous OilRig Advanced Persistent Threat (APT) group that has been active in the Middle East and Turkiye for over a decade. The group is known for targeting high-profile government entities across the Middle East, Turkiye and Africa for cyberespionage purposes.<\/strong><\/p>\n\n\n\n

The OilRig APT commonly uses social engineering tactics, exploits software and technical vulnerabilities within its victims. However, Kaspersky experts noticed the group has updated their arsenal, resorting to persistent, stealthier ways of infiltrating their targets throughthird-party IT companies.<\/p>\n\n\n\n

During an ongoing investigation that started in late 2022, Kaspersky experts discovered that the APT group has executed PowerShell scripts to gain access to terminal servers at IT companies in the region to collect credentials and sensitive data about their targets. The group used the stolen information to infiltrate their targets and deploy malware samples that relied on Microsoft Exchange Web Services to perform Command & Control (C2) communications, and steal data. The investigated malware appeared to be a variant of an older malware used by the threat actor. <\/p>\n\n\n\n

To ensure persistent stealthy access, the group deployed a new DLL-based password filter, which enabled them to intercept local\/domain password changes. This allowed the attackers to receive updated passwords along with other stolen and sensitive data sent from their targets\u2019 email services to attacker-controlled Protonmail and Gmail addresses.<\/p>\n\n\n\n

\"Maher<\/a><\/figure>\n\n\n\n

\u201cOilRig has taken the meaning of \u201cstealth mode\u201d to the next level with its complex and heavily modified tactics, techniques, and procedures to exploit third-party IT companies. It is evident from our investigation that third-party attacks are stealthier, agile and remain undetected in comparison to other tactics, posing a grave risk to the functioning of government entities in this region. The radical shift to infiltrate IT companies that are part of a supply chain is an indication that regional government entities are stepping up their cybersecurity game, driving APT groups to think out of the box\u201d <\/em>said Maher Yamout, Senior Security Researcher at Kaspersky.<\/strong><\/p>\n\n\n\n

Kaspersky researchers recommend governments and businesses follow the below tips and protect themselves from falling victim to third-party supply chain attacks:<\/strong><\/p>\n\n\n\n