OilRig’s persistent attacks using cloud service-powered downloaders

ESET researchers detail OilRig (Lyceum/APT34) activity where a set of lightweight downloaders (SC5k v1–v3, ODAgent, OilCheck, OilBooster) were used throughout 2022 to maintain persistent access to Israeli targets by abusing Microsoft cloud services (OneDrive, Outlook/EWS, Microsoft Graph) for command-and-control and exfiltration; the report provides technical analysis of each downloader, TTP mapping to MITRE ATT&CK, and IoCs including file hashes and a fallback C2 domain.