APT34: OilRig — Iran's DNS Tunnelling Specialists Targeting Critical Infrastructure Across the Middle East

The group that turned DNS into an exfiltration channel.

APT34 — also tracked as OilRig, Helix Kitten, Earth Simnavaz, Crambus, Cobalt Gypsy, Hazel Sandstorm, EUROPIUM, Evasive Serpens, ITG13, and TA452 — is an Iranian state-sponsored cyber espionage group that has been operating since at least 2014. The group is assessed to work on behalf of Iran's Ministry of Intelligence and Security (MOIS), conducting sustained intelligence collection campaigns targeting government agencies, energy companies, financial institutions, telecommunications providers, and critical infrastructure — primarily across the Middle East, with the Persian Gulf states as the focal point.

APT34's calling card is DNS tunnelling. While many threat groups use DNS for basic C2 communications, APT34 has elevated it to an art form — building custom backdoors specifically designed to exfiltrate data and receive commands through DNS queries. This technique is remarkably effective because DNS traffic is permitted through virtually every firewall, is rarely inspected at the content level, and blends with the millions of legitimate DNS queries that any organisation generates daily. When APT34 is inside your network, your data may be leaving through the same protocol that resolves your email server's hostname.

APT34 is also notable for surviving what should have been an operational catastrophe. In April 2019, an anonymous entity leaked the group's entire toolkit — source code for backdoors, web shells, credential dumping tools, and operational infrastructure details — via Telegram. This would have been terminal for most threat groups. APT34 rebuilt, retooled, and continued operating. Their campaigns in 2023, 2024, and into 2025 demonstrate not just recovery but evolution — incorporating cloud-based C2, Microsoft Exchange abuse, steganography, and zero-day exploitation.

Linking APT34 to Iran's MOIS.

Intelligence collection for Iranian strategic advantage.

APT34's targeting aligns with MOIS intelligence requirements — understanding the political, economic, and military posture of Gulf states and regional adversaries. Notably, APT34 does not limit its targeting to Iran's enemies: Check Point documented sustained espionage against Iraqi government entities in 2024–2025, despite Iraq being a nominal Iranian ally. As one researcher noted, diplomatic ties with Iran do not preclude cyberespionage.

APT34's signature technique — hiding in plain sight.

DNS tunnelling is APT34's most distinctive and operationally significant technique. Multiple APT34 backdoors — including Helminth, BONDUPDATER, Glimpse, and others — use DNS as their primary command-and-control channel. Understanding how this works reveals why it is so effective and so difficult to detect.

Detecting APT34's DNS tunnelling requires DNS query logging and analysis — specifically, monitoring for anomalously long subdomain labels, high query volumes to previously unseen domains, unusual TXT record responses, and entropy analysis on subdomain strings (Base64-encoded data has a distinctive entropy signature). Organisations that do not log and analyse DNS traffic have a significant blind spot that APT34 actively exploits.

A decade of custom backdoors — evolved and rebuilt.

Spear-phishing, supply chains, and LinkedIn invitations.

An operational catastrophe that APT34 survived.

In April 2019, an anonymous entity began leaking APT34's complete operational toolkit via a Telegram channel. The leak included source code for web shells (HighShell, HyperShell), hacking tools (Fox Panel), DNS tunnelling utilities (Glimpse — related to BONDUPDATER), DNS hijacking scripts (Webmask), and the TwoFace web shell family. Victim data from compromised organisations was also exposed.

For most threat groups, this level of exposure would be operationally terminal. Every security vendor received the source code, enabling signature development for every tool. Every defender could identify APT34's presence in their networks by scanning for the leaked indicators. The leak also exposed operational security failures — giving defenders and intelligence agencies insight into APT34's infrastructure, targeting, and methodology.

APT34 survived. Within months, they deployed updated tooling with modified signatures, new C2 protocols, and different evasion techniques. By 2020, Unit 42 documented fresh campaigns using steganography — a capability not present in the leaked toolkit. By 2023, ESET documented entirely new cloud-service-powered downloaders. By 2024, Check Point documented bespoke backdoors using hijacked government email addresses for C2. The 2019 leak forced a complete retool, but APT34's mission, targeting, and operational tempo continued uninterrupted. The state protection and funding behind the group simply absorbed the blow and rebuilt.

ZeroCleare — when espionage turns destructive.

APT34 is primarily an espionage group, but it has connections to destructive operations. In December 2019, IBM X-Force documented ZeroCleare — a destructive wiper malware targeting the energy sector in the Middle East. ZeroCleare used the legitimate EldoS RawDisk driver to bypass Windows security controls and directly overwrite the Master Boot Record (MBR) and disk partitions, rendering systems unbootable.

ZeroCleare was linked to both APT34 and APT33 (Elfin) infrastructure — suggesting collaborative development or shared resources between the two Iranian groups. The deployment against energy sector targets echoes the Shamoon attacks of 2012, 2016, and 2018, reinforcing that Iranian threat groups maintain destructive capabilities alongside their espionage operations. For defenders in the energy sector, an APT34 intrusion cannot be treated as 'merely' espionage — the same access that enables intelligence collection could be used to deploy a wiper.

Defending against DNS tunnelling and supply chain trust.

Where APT34 fits in Iran's intelligence ecosystem.

Iran's cyber operations are conducted by two distinct intelligence structures — the Ministry of Intelligence and Security (MOIS) and the Islamic Revolutionary Guard Corps (IRGC). Understanding which structure sponsors a group helps predict their targeting patterns and operational behaviour.

APT34's MOIS affiliation means its targeting is driven by civilian intelligence priorities — understanding regional adversaries and allies, supporting sanctions evasion, monitoring energy competitors, and collecting strategic intelligence. The MOIS groups (APT34, APT39, MuddyWater) tend to focus on Middle Eastern infrastructure and institutions, while IRGC groups (APT35, APT42, APT33) have broader global reach and more varied targeting including individuals, political campaigns, and aerospace/defence sectors.

The bottom line.

APT34 is one of Iran's most technically capable and persistent cyber espionage groups. Operating on behalf of MOIS since at least 2014, they have conducted sustained intelligence collection against government, energy, financial, and telecommunications targets across the Middle East — including allies such as Iraq. Their signature DNS tunnelling C2 technique enables stealthy data exfiltration through a protocol that virtually every network permits and few organisations monitor.

The group's resilience is remarkable. The 2019 leak of their entire toolkit — source code, web shells, operational infrastructure — would have ended most threat groups. APT34 rebuilt and evolved, incorporating cloud-based C2, steganography, hijacked email addresses for command channels, and zero-day exploitation. Their 2024–2025 campaigns against Iraqi and Yemeni government entities demonstrate that the group is not just surviving but advancing.

For organisations in APT34's target sectors — particularly government, energy, financial services, and telecoms in the Middle East — the defensive priority is DNS monitoring. If you are not logging, analysing, and alerting on DNS query content, you have a blind spot that APT34 has spent a decade learning to exploit. Beyond DNS, defenders must address macro-based phishing, supply chain trust relationships, web server integrity, and the possibility that any espionage intrusion could pivot to destructive wiper deployment. APT34 is an espionage group that maintains the capability and the willingness to destroy what it has penetrated.