LiveActive security incident?Get immediate response
MITRE ATT&CK® Campaign

C0044: Juicy Mix

Juicy Mix was a campaign conducted by OilRig throughout 2022 that targeted Israeli organizations with the Mango backdoor.[1]

EnterpriseC0044CampaignObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Juicy Mix is a historical 2022 campaign attributed in ATT&CK to OilRig that targeted Israeli organizations using the Mango C#/.NET backdoor. Its defensive value is that it ties together identity theft, Windows execution and persistence, discovery, local data staging, and web-based command-and-control behaviors that can materially affect incident scope and recovery decisions.

Executive priority

Treat this as a validation case for whether the organization can prove coverage across endpoint execution, credential protection, and outbound web traffic monitoring. The most business-relevant questions are: can security teams see suspicious scheduled tasks, PowerShell/VB/.NET activity, browser or Windows Credential Manager access, local data staging, and encoded web C2-like traffic; and can incident responders quickly determine whether credentials or staged data were exposed?

Technical view

ATT&CK does not provide campaign-level detection text or platforms for Juicy Mix, but the relationships point defenders toward Mango on Windows and techniques including Scheduled Task, PowerShell, Visual Basic, web protocols for C2, local data staging, system/software/browser discovery, browser credential access, Windows Credential Manager access, standard encoding, and deobfuscation/decoding. SOC and IR teams should validate telemetry and detections around those behaviors rather than relying on the campaign name alone.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry for PowerShell, VB-related execution, .NET processes, and task scheduler activity
  • Scheduled task creation, modification, and execution records
  • Endpoint file activity showing local staging directories, unusual file aggregation, decoding/deobfuscation activity, or backdoor-related artifacts
  • Credential access evidence involving browser credential stores and Windows Credential Manager/Vault access
  • Host discovery telemetry for system, software, and browser enumeration

Detection direction

  • Because official campaign detection is not provided, build coverage from the related software and techniques rather than assuming a single signature will identify the campaign.
  • Tune detections for suspicious scheduled tasks and script execution while accounting for legitimate administration, software deployment, and automation activity.
  • Correlate credential-store access with unusual script/.NET execution, discovery commands, local staging, and outbound web traffic to reduce false positives.
  • Review visibility gaps around encoded web traffic, TLS inspection limitations, proxy logging retention, and endpoint command-line capture.
  • Use relationship-driven context: Mango is associated with Windows, while several related techniques are cross-platform or PRE; validate only the platforms that exist in the local environment.

Mitigation priorities

  • Prioritize hardening and monitoring of Windows endpoints where Mango-related behavior is relevant, including script execution controls and scheduled task governance.
  • Reduce credential exposure by limiting saved browser credentials where feasible, strengthening credential vault protections, and enforcing strong identity controls such as MFA and least privilege.
  • Constrain and monitor outbound web traffic through managed egress, proxy logging, and anomaly review for unusual destinations or encoded payload patterns.
  • Improve endpoint logging retention for process creation, command lines, task scheduler events, file staging activity, and credential access signals.
  • Prepare IR decision points for containment, credential reset scope, and data exposure review when discovery, staging, or credential-access behaviors are observed.
Additional notes and limits

This take is based on ATT&CK campaign C0044, its official description, the ESET external reference, and listed relationships to OilRig, Mango, and associated techniques. It is most useful as a control-validation and hunt-planning brief, not as a claim of current activity or guaranteed detection.

The campaign object does not specify platforms, tactics, or official detection guidance. Platform-specific recommendations are inferred only from related Mango and technique records, especially Windows-linked relationships. Local telemetry, asset mix, and approved threat intelligence are required to determine actual exposure and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Juicy Mix

Juicy Mix was a campaign conducted by OilRig throughout 2022 that targeted Israeli organizations with the Mango backdoor.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

14 rows
DomainIDNameRelationship / procedure
EnterpriseT1140Deobfuscate/Decode Files or Information

During Juicy Mix, OilRig used a script to concatenate and deobfuscate encoded strings in Mango.[1]

EnterpriseT1217Browser Information Discovery

During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) data stealers to collect cookies, browsing history, and credentials.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

During Juicy Mix, OilRig used VBS droppers to schedule tasks for persistence.[1]

EnterpriseT1132.001Standard EncodingSub-technique

During Juicy Mix, OilRig used a VBS script to send the Base64-encoded name of the compromised computer to C2.[1]

EnterpriseT1518Software Discovery

During Juicy Mix, OilRig used browser data dumper tools to create a list of users with Google Chrome installed.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

During Juicy Mix, OilRig used a VBS script to send POST requests to register installed malware with C2.[1]

EnterpriseT1059.001PowerShellSub-technique

During Juicy Mix, OilRig used a PowerShell script to steal credentials.[1]

EnterpriseT1074.001Local Data StagingSub-technique

During Juicy Mix, OilRig used browser data and credential stealer tools to stage stolen files named Cupdate, Eupdate, and IUpdate in the %TEMP% directory.[1]

EnterpriseT1082System Information Discovery

During Juicy Mix, OilRig used a script to send the name of the compromised host via HTTP `POST` to register it with C2.[1]

EnterpriseT1587.001MalwareSub-technique

For Juicy Mix, OilRig improved on Solar by developing the Mango backdoor.[1]

EnterpriseT1555.004Windows Credential ManagerSub-technique

During Juicy Mix, OilRig used a Windows Credential Manager stealer for credential access.[1]

EnterpriseT1059.005Visual BasicSub-technique

During Juicy Mix, OilRig used VBS droppers to deliver and establish persistence for the Mango backdoor.[1]

EnterpriseT1584.004ServerSub-technique

During Juicy Mix, OilRig compromised an Israeli job portal to use for a C2 server.[1]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) to collect credentials.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0049: OilRig

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]

MalwareEnterprise

S1169: Mango

Mango is a first-stage backdoor written in C#/.NET that was used by OilRig during the Juicy Mix campaign. Mango is the successor to Solar and includes additional exfiltration capabilities, the use of native APIs, and added detection evasion code.[1]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1217: Browser Information DiscoveryEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · MalwareS1169: MangoEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1587.001: MalwareEnterpriseuses · TechniqueT1555.004: Windows Credential ManagerEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseattributed to · GroupG0049: OilRigEnterpriseuses · TechniqueT1584.004: ServerEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
5477675b5a562e34...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle5477675b5a56…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  2. [2]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  3. [3]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  4. [4]
    mitre-attackC0044
    Open source URL
  5. [5]
    mitre-attackC0044
    Open source URL
  6. [6]
    mitre-attackC0044
    Open source URL
  7. [7]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  8. [8]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  9. [9]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  10. [10]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  11. [11]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  12. [12]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  13. [13]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  14. [14]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  15. [15]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  16. [16]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  17. [17]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  18. [18]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  19. [19]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  20. [20]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  21. [21]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  22. [22]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  23. [23]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  24. [24]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  25. [25]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  26. [26]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  27. [27]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  28. [28]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  29. [29]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  30. [30]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  31. [31]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  32. [32]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  33. [33]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  34. [34]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
  35. [35]
    ESET OilRig Campaigns Sep 2023

    Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use