While this is not a new tactic, this is the first instance where we have observed the OilRig using it in their playbook. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time. The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure: http://<c2 domain>/resp. hex(Environment.UserName/Environment.MachineName)>AAZ<hex("File Uploaded")> The download command (3) reads the contents of a specified file and sends the data to the C2 server. If the file does not exist, the Trojan will send the C2 server a message < File Not Found > by sending the following URL: http://<c2 domain>/resp. hex(Environment.UserName/Environment.MachineName)>AAZ<hex("< File Not Found >")> If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class. hex(Environment.UserName/Environment.MachineName)>ABZFinish Overlaps with Previous OilRig Group Attacks Since May 2016, we have continued to monitor and uncover various attacks and tools associated with the OilRig group. However, as we continued to follow the trail of evidence, we found immediate links to past attacks and common artifacts from the OilRig group. This group has repeatedly shown evidence of a willingness to adapt and evolve their tactics, while also reusing certain aspects as well. 2) AutoFocus customers can track these tools with the ThreeDollars and OopsIE 3) Traps blocks the ThreeDollars delivery documents and the OopsIE payload