The Iran-linked OilRig APT group is now using a new Trojan called OopsIE. Palo Alto Networks observed the new malware being used in recent attacks against an insurance agency and a financial institution in the Middle East. The hackers gain persistence by creating a VBScript file and a scheduled task to run itself every three minutes. The OopsIE Trojan is configured to use a C2 server hosted at: www.msoffice365cdn[.]com. The Trojan is packed with SmartAssembly and obfuscated with ConfuserEx.”]
Source: https://securityaffairs.co/wordpress/69470/malware/oilrig-oopsie-trojan.html