The PolySwarm Blog

Executive Summary

Using PolySwarm’s knowledge graph, PolyKG, PolySwarm analysts have identified previously unreported OilRig activity leveraging a stolen Entrust Extended Validation (EV) code signing certificate issued to Thai IT vendor MOSCII Corporation. The certificate was used to sign multiple malware samples, including the Karkoff backdoor, alongside additional undetected payloads with minimal antivirus coverage. The use of a legitimate vendor certificate and EGAT-themed naming potentially suggests a supply chain intrusion targeting Thailand’s energy sector. This activity highlights a continued evolution in OilRig tradecraft, combining trusted infrastructure abuse with low-detection tooling to enable stealthy, persistent access.