KELA’s latest profile of APT34, also known as OilRig, is a useful reminder that Iranian cyber operations do not have to look loud to be dangerous. The most concerning part of the reporting is not one exotic malware family. It is the way the actor turns normal enterprise systems — Exchange, DNS, IIS, domain credentials, remote access, and service-provider trust — into the intrusion path.

For small and mid-sized businesses, managed service providers, and government contractors, that matters because the same systems that keep the organization running are also the systems that make a quiet espionage operation hard to see. If the attacker is using valid accounts, internal mail flow, and trusted infrastructure, a malware-only defense program will miss too much.

What KELA reported

KELA describes APT34 as an Iran-linked espionage group active for more than a decade, with targeting that has expanded from its Middle East core into U.S., European, and Asian organizations. The group’s victim profile includes government, energy, telecommunications, finance, aviation, chemical, and IT service-provider environments.

The report highlights several tradecraft patterns defenders should take seriously:

  • Exchange and email-based command paths: backdoors that receive instructions or exfiltrate data through mail services can blend into ordinary business traffic.
  • DNS tunneling: command-and-control traffic hidden in DNS queries or records is especially dangerous where resolver logs are retained but rarely reviewed.
  • IIS web shells: externally reachable Microsoft infrastructure remains a high-value persistence layer after initial compromise.
  • Password-filter DLL abuse: malicious code on identity infrastructure can capture fresh plaintext passwords as users change them.
  • Living-off-the-land operations: stolen credentials and native administration tools reduce the amount of obvious malware defenders can hunt for.

Original source: KELA — Iran’s APTs and the U.S. Enterprise in 2026: APT34 (OilRig).

Why this matters for U.S. contractors and SMBs

APT34 is often discussed as a nation-state problem, but the defensive lesson is broader. Many smaller organizations have the exact conditions this tradecraft depends on: internet-facing Microsoft services, over-privileged admin accounts, limited DNS telemetry, weak mailbox auditing, and reliance on a few trusted vendors for remote support.

The report also points to supply-chain and provider access as a practical risk. An organization does not need to be a direct geopolitical target to become useful. A contractor, MSP customer, regional energy supplier, professional-services firm, or downstream vendor may provide identity access, mailbox intelligence, infrastructure knowledge, or partner relationships that help an actor reach a more strategic target.

Defensive takeaways

1. Treat identity infrastructure as Tier 0

Domain controllers, Entra ID administration, Exchange administration, federation services, and privileged access workstations should be treated as crown-jewel systems. Limit who can administer them, require phishing-resistant MFA for privileged roles, and separate daily-use accounts from admin accounts.

2. Hunt for identity abuse, not only malware

Look for unusual successful logins, mailbox access from new locations, new forwarding or inbox rules, abnormal service-account use, unexpected PowerShell against Exchange, and privileged activity outside maintenance windows. If the actor is operating with valid credentials, authentication and audit logs become the primary evidence source.

3. Monitor DNS like a security control

DNS is not just plumbing. Retain resolver logs, alert on unusual TXT-query volume, rare domains, high-entropy subdomains, and endpoints that suddenly generate DNS patterns unlike their baseline. DNS tunneling is easier to detect when resolver telemetry is centralized and searchable.

4. Lock down Exchange and IIS exposure

Patch internet-facing Microsoft services quickly, remove unnecessary exposure, restrict admin interfaces, and watch for suspicious files in web directories. Web shells do not always announce themselves with noisy malware behavior; file integrity monitoring and web-server logging still matter.

5. Control vendor and remote-access trust

Every MSP, IT provider, telecom relationship, remote tool, and support account should have a named owner, MFA, least privilege, logging, and expiration/review cadence. Vendor access should be segmented from sensitive internal systems by default, not granted broad reach because it is convenient.

Bulwark Black assessment

APT34’s current value is not just in custom tools. It is in knowing where enterprise trust is weak. Exchange is trusted. DNS is trusted. Domain controllers are trusted. Service providers are trusted. That is exactly why defenders should build detections around trust abuse rather than waiting for a clean malware signature.

The practical move for most organizations is straightforward: map the identity and mail systems that would let an attacker become “normal,” then build controls and hunts around those systems first. If a breach would be quietest through Exchange, DNS, remote support, or admin credentials, those are not back-office systems. They are the front line.