Lab Dookhtegan: leaks on Iran's APT34 / OilRig
Alleged: Reported or claimed; not established in the public record.
From March 2019 an anonymous persona posted tools, victim data and claims about operators of the Iran-linked hacking group known as APT34 or OilRig. Security firms analysed what was posted.
Confirmed
Chronicle (Google's security unit) confirmed the data is associated with APT34/OilRig, as reported by BleepingComputer. Wired reported 66 victim organisations in the material.
Claimed, disputed or not established
Wired could not confirm the identities the persona named, so this site does not repeat them. Who is behind the persona and why is unknown. A 2024 Recorded Future report on later Iranian leak groups said such groups are "highly likely" a sign of internal discontent, which is that firm's assessment.
Reported impact
Exposed tools and victim information and sent defenders to check their networks.
Sources (opened in a new tab)
- BleepingComputer: hacker group exposes Iranian APT operations ↗https://www.bleepingcomputer.com/news/security/hacker-group-exposes-iranian-apt-operations-and-members/
- Wired: Iran hackers OilRig, read my lips ↗https://www.wired.com/story/iran-hackers-oilrig-read-my-lips/
- SecurityWeek: source code of Iran-linked hacking tools posted online ↗https://www.securityweek.com/source-code-iran-linked-hacking-tools-posted-online/
- Recorded Future Insikt Group report on Iranian leak groups (Jan 2024) ↗https://assets.recordedfuture.com/insikt-report-pdfs/2024/cta-2024-0125.pdf
Connected
- Related leaks: Iran Atomic Energy Organization email leak
- Case board · Timeline (2019) · Document vault · How we verify leaks
This page describes and cites public reporting. It does not host or link to leaked files, and it names no private individuals.