Oil and Gas Industries in Middle East Targeted

Zscaler ThreatLabZ observed a targeted email campaign (since Jan–May 2020 with increased activity from July 2020) that uses malicious PDF attachments impersonating ADNOC-related RFQs; the PDFs host links to ZIP archives containing a packed .NET loader which unpacks multiple staged DLLs (Aphrodite, Jupiter) and ultimately injects the AZORult infostealer via process hollowing to exfiltrate data to crevisoft.net. The report includes technical analysis of packing/decryption, extensive sandbox/anti-VM checks, C2 artifacts, PHP mailer scripts, a MITRE ATT&CK mapping, and many IoCs (hashes, URLs, scheduled task names and dropped filenames) to aid detection and response.