UPDATE (June 5 th, 2025): Since publishing this blogpost, we have updated our tracking to better reflect the full range and complexity of the malicious activities carried out by the OilRig APT group.