Introduction
DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. Unit 42 DarkHydrus July 2018 Unit 42 Playbook Dec 2017
Activities and Tactics
Country of Origin: 🇮🇷 Iran
Notable Campaigns
- 2018
- 2018-06
- 2018-07
- 2019-01
- 2019. A backdoor dropped by macro in the lure documents can communicate with C2 server through DNS tunnel
- 360 Threat Intelligence Center captured several lure Excel documents written in Arabic in January 9
- Attack on Middle East Government
- New Attacks in the Middle East
- On June 24
- This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy).
- Unit 42 observed DarkHydrus carrying out a credential harvesting attack on an educational institution in the Middle East. The attack involved a spear-phishing email with a subject of “Project Offer” and a malicious Word document as an attachment.
- as well as Google Drive API.
- https://ti.360.net/blog/articles/latest-target-attack-of-darkhydruns-group-against-middle-east-en/
- https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/
- https://unit42.paloaltonetworks.com/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/
- https://unit42.paloaltonetworks.com/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Tactics, Techniques, and Procedures (TTPs)
- T1204.002 Malicious File
- T1187 Forced Authentication
- T1564.003 Hidden Window
- T1059.001 PowerShell
- T1566.001 Spearphishing Attachment
- T1221 Template Injection
- T1588.002 Tool
ATT&CK technique IDs (denormalized)
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- RogueRobin:
- Cobalt Strike:
- Mimikatz:
- Phishery:
MITRE ATT&CK Software
Attribution and Evidence
Country of Origin: Iran Additional attribution information pending cataloguing.
References
[1] mitre-attack [3] Unit 42 DarkHydrus July 2018 Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018. [4] Unit 42 Playbook Dec 2017 Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.