The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor - Palo Alto Networks BlogPalo Alto Networks Blog

OilRig targeted Saudi Arabian financial and technology organizations, delivering the HelmINTH backdoor via two variants—a macro-delivered VBScript/PowerShell via Excel spreadsheets (ClaySlide) and a standalone Windows executable (HerHer dropper). The campaigns used social engineering, decoy content, and both HTTP and DNS C2 channels to control and exfiltrate data, including a keystroke-logging module in the executable variant, with shared infrastructure across variants and potential Iranian-linked artifacts.