ESET Research documented in a report published on ESET Research two consecutive OilRig (APT34/Lyceum) campaigns exclusively targeting Israeli organizations: Outer Space (2021) and Juicy Mix (2022). Both campaigns followed an identical playbook — compromising legitimate Israeli websites for C2, deploying VBS droppers via spearphishing, and using C#/.NET first-stage backdoors alongside credential and browser data theft tools. ESET notified the Israeli national CERT about the compromised Israeli human resources and job portal websites used as C2 infrastructure.
Solar Backdoor (Outer Space): Astronomy-Named Tasks, XOR+Base64 C2, Automated Venus Exfiltration
Solar (Solar.exe) uses an astronomy-themed naming convention throughout — functions MercuryToSun, JupiterE/JupiterD/JupiterX (XOR encryption using hardcoded key 6sEj7*0B7#7 plus a 2–24 character random hex nonce, followed by base64 encoding), and scheduled tasks named Earth (30-second interval, primary C2 loop) and Venus (40-second interval, automated exfiltration). The Earth task sends hostname and version info to the C2 via URI parameter rt=d for download, parsing responses between QQ@ and @kk delimiters as asterisk-delimited command arrays. Output is gzip compressed (function Neptune), XOR encrypted with a new nonce, and uploaded with rt=u. Venus copies files from a local "Venus" staging directory to C2 then deletes them, enabling automated exfiltration of files deposited by other OilRig tools. The C2 was a compromised Israeli HR company website.
Mango Backdoor (Juicy Mix): Symbol Obfuscation, TLS, MD5 Victim ID, and Native API Execution
Mango is Solar's successor with notable hardening: all symbol names are obfuscated (vs. Solar's astronomy names), string stacking replaces plaintext strings, TLS is used for C2 communications, and native Windows APIs (rather than .NET APIs) execute files and shell commands. The victim identifier is computed as MD5(machine_name + username) formatted as hex. C2 requests send d@<victimID>@<machine_name>|<username> XOR-encrypted with key Q&4g, base64-encoded, and inserted at a pseudorandom position within a random 3–14 character string between [@ and @] delimiters. C2 responses use the same encoding, with commands either NCNT (no action) or @-delimited parameter strings. The C2 was a compromised Israeli job portal (darush.co[.]il). Automated Venus exfiltration is replaced by a dedicated exfiltration backdoor command; detection evasion code was introduced though not actively used at time of analysis.
VBS Droppers, SC5k Exchange Web Services Downloader, and Credential/Browser Theft Tools
Both campaigns use VBS droppers with identical string obfuscation: strings assembled via arithmetic operations and Chr(), with Mango's dropper adding a second layer replacing characters from the set #*+-_)(}{@$%^& with 0, then converting three-digit ASCII numbers (e.g. the string 116110101109117+99111$68+77{79$68}46-50108109120115}77 decodes to Msxml2.DOMDocument). Droppers create a scheduled task every 14 minutes and send the base64-encoded computer name to the C2 as a registration beacon. The SC5k downloader (Outer Space) uses the Microsoft Office Exchange Web Services API for C2 communication — matching upload/download subdirectory patterns seen in ALMA, Shark, DanBot, and Milan OilRig backdoors. Post-compromise tools include MKG (custom Chrome data dumper), CDumper and EDumper (Chrome and Edge browser cookie/history/credential stealers), and IDumper (PowerShell-based Windows Credential Manager stealer writing output to %TEMP%\IUpdate).