Threat profile of APT34 / OilRig (G0049): TTPs across the kill chain, malware families, DNS-tunnelling C2 detection and D3FEND countermeasures
-
Updated
Oct 15, 2026
#
oilrig
Here are 3 public repositories matching this topic...
Iranian APT DNS-transport C2 research. Investigation into Cavern Manticore / Project CAV3RN infrastructure, yielding a novel RFC 2308 non-compliance fingerprint for DNS-transport C2 servers. Two unreported relays documented from public data. Sigma, KQL, Suricata, sweep tooling. Graded evidence, full retraction log.
iran threat-intelligence dns-tunneling dns-tunneling-detection muddywater iranian-apt cavern-manticore cav3rn oilrig
-
Updated
Aug 25, 2026
APT34 (OilRig) threat intelligence: public-source campaign research, MITRE ATT&CK mappings, and defensive detection and hunting guidance.
incident-response threat-hunting threat-intelligence security-research defensive-security apt34 mitre-attck oilrig cyber-threat-intel oilrig-apt34 cyber-espionage
-
Updated
Oct 18, 2026
Add this topic to your repo
To associate your repository with the oilrig topic, visit your repo's landing page and select "manage topics."