New 'SandViper' APT Group Targets Global Energy Sector with 'DuneStalker' Backdoor

Executive Summary

Security firm Dragos Inc. has identified a new advanced persistent threat (APT) group, named SandViper, conducting a widespread cyber-espionage campaign against the global energy sector. The campaign primarily targets oil and gas companies, particularly those involved in liquefied natural gas (LNG) in the Middle East and Europe. The group employs a new, modular backdoor called DuneStalker to achieve its objectives. The malware is designed for stealth and long-term persistence, enabling the theft of highly sensitive operational technology (OT) and proprietary business data. The campaign highlights the increasing focus of sophisticated threat actors on critical infrastructure for strategic intelligence gathering.

Threat Overview

SandViper is a highly sophisticated threat actor that has been active since at least late 2025. Their operations demonstrate a deep understanding of the energy sector, targeting specific individuals like engineers and project managers with tailored social engineering lures.

• Targeting: The group's targets are not random. They are focused on oil and gas companies in strategic locations, including Saudi Arabia, the UAE, Qatar, and Germany, with a specific interest in LNG operations.
• Initial Access: The attack chain begins with spear-phishing emails containing links to watering hole sites. These sites are designed to look like legitimate project management portals relevant to the energy sector. The sites exploit a browser vulnerability to drop the initial stage of the DuneStalker malware.
• Malware: DuneStalker is a multi-stage, modular backdoor. This architecture allows the attackers to deploy specific modules based on the target environment, enhancing stealth and functionality. Its primary purpose is to collect and exfiltrate sensitive data.

Technical Analysis

The SandViper campaign is notable for its patience and focus on stealth. The use of a watering hole attack combined with a browser exploit is a sophisticated method for gaining initial access that can bypass some traditional email security.

The DuneStalker malware is designed to operate under the radar. Its modularity allows it to load different capabilities as needed, such as:

• A reconnaissance module to map the internal network and identify OT systems.
• A keylogging and screen-capturing module to steal credentials and monitor user activity.
• A file-collection module that can target specific file types related to geological surveys (.dxf, .dwg) and production data.
• A stealthy exfiltration module that likely uses encrypted channels and steganography to send data back to the C2 server.

While Dragos has not made a formal attribution, they note that SandViper's TTPs and targeting align with the strategic interests of nation-states like Russia and Iran, both of which have a history of targeting the energy sector.

MITRE ATT&CK TTPs

• Initial Access: T1566.002 - Spearphishing Link - Sending emails with links to malicious sites.
• Initial Access: T1189 - Drive-by Compromise - Exploiting a browser vulnerability on the watering hole site.
• Execution: T1203 - Exploitation for Client Execution - The browser exploit that drops the malware.
• Persistence: T1547.001 - Registry Run Keys / Startup Folder - A likely method for the backdoor to maintain persistence.
• Collection: T1005 - Data from Local System - Collecting sensitive files related to OT and business operations.
• Command and Control: T1071.001 - Web Protocols - DuneStalker likely uses HTTP/S for C2 communications.
• Exfiltration: T1048 - Exfiltration Over Alternative Protocol - Stealing the collected OT and project data.

Impact Assessment

The primary impact of this campaign is economic and strategic espionage. By stealing sensitive data, SandViper's sponsors can gain significant advantages:

• Economic Advantage: Access to proprietary geological survey data, drilling plans, and LNG production metrics can provide a competitive edge in the multi-trillion-dollar energy market.
• Strategic Intelligence: Understanding the operational capabilities and future plans of major energy producers provides valuable geopolitical intelligence.
• Foundation for Future Attacks: The access and information gained could be used to plan future disruptive or destructive attacks against the victims' OT environments, posing a risk to critical infrastructure.

IOCs — Directly from Articles

The Dragos report is said to contain a full list of IOCs, but they were not enumerated in the source articles. Organizations in the energy sector are advised to obtain the full report from Dragos for these details.

Detection & Response

• Detection:
  • Monitor for spear-phishing attempts and train users to recognize and report them.
  • Use web proxies and DNS filtering to block access to known malicious domains and newly registered domains that are often used in watering hole attacks.
  • Deploy EDR solutions to detect the execution of browser exploits and the subsequent dropping of malware payloads. Use D3FEND's Process Analysis.
  • Monitor network traffic for anomalous connections from corporate networks to external hosts, especially from systems in the OT environment.
• Response:
  • If a compromise is suspected, isolate the affected workstations and servers.
  • Conduct a forensic analysis to determine the scope of the compromise and what data was exfiltrated.
  • Review and reset credentials for all users and systems in the affected network segments.

Mitigation

• Browser Security: Ensure all web browsers are kept up-to-date with the latest security patches to prevent drive-by compromise attacks.
• Email Security: Implement advanced email security solutions that can analyze links and detect phishing attempts.
• Network Segmentation: Maintain a strict separation between IT and OT networks. Monitor and control all traffic that passes between these two environments.
• User Training: Conduct regular user awareness training focused on identifying spear-phishing and social engineering attempts.
• Threat Intelligence: Organizations in the energy sector should subscribe to and consume threat intelligence feeds specific to their industry, such as the information provided by Dragos and other ICS/OT security vendors.