During Juicy Mix, OilRig used VBS droppers to schedule tasks for persistence.2
campaign
Juicy Mix C0044
- First seen
- January 2022
- Last seen
- December 2022
- Created
- 25 November 2024
- Last modified
- 31 July 2026
Juicy Mix was a campaign conducted by OilRig throughout 2022 that targeted Israeli organizations with the Mango backdoor.[1]
14
Techniques38th pct
9
Tactics54th pct
1
Tool or malware45th pct
1
Threat groupunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0044
During Juicy Mix, OilRig used a PowerShell script to steal credentials.3
During Juicy Mix, OilRig used VBS droppers to deliver and establish persistence for the Mango backdoor.4
During Juicy Mix, OilRig used a VBS script to send POST requests to register installed malware with C2.5
During Juicy Mix, OilRig used browser data and credential stealer tools to stage stolen files named Cupdate, Eupdate, and IUpdate in the %TEMP% directory.6
During Juicy Mix, OilRig used a script to send the name of the compromised host via HTTP POST to register it with C2.7
Standing C0044
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques1438th pct
38th percentile · 62% of 56 ATT&CK campaigns have more Enterprise techniques.
Tactics954th pct
54th percentile · 54% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tool or malware145th pct
45th percentile · 55% of 56 ATT&CK campaigns have more tools and malware.
Threat group155% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique12.5med41st pct
41st percentile · 59% of 56 ATT&CK campaigns have more detection rules per technique.
Tests / technique4.5med
Detection coverage C0044
563 distinct rules cover the 14 techniques recorded for this campaign. The 592 technique-to-rule mappings resolve to 563 distinct rules, because one rule can cover several techniques. 424 Sigma · 139 Splunk.
13 covered by at least one rule1 with no coverage563 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org