DarkHydrus

· ATT&CK GroupG0079

Techniques

Software

Tactics

Aliases

Description

DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. (Citation: Unit 42 DarkHydrus July 2018) (Citation: Unit 42 Playbook Dec 2017)

Tactic Coverage

execution (2)stealth (2)credential access (1)initial access (1)resource development (1)

Techniques Used (7)

T1059.001PowerShell

execution

T1187Forced Authentication

credential access

T1204.002Malicious File

execution

T1221Template Injection

stealth

T1564.003Hidden Window

stealth

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 7 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (3)

S0154Cobalt Strikemalware S0002Mimikatztool S0270RogueRobinmalware

References (4)

https://attack.mitre.org/groups/G0079 https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/https://pan-unit42.github.io/playbook_viewer/