DarkHydrus - G0079

Created: 2018-10-17T00:14:20.652Z

Modified: 2021-10-12T19:52:22.454Z

Contributors: Oleg Skulkin, Group-IB

Aliases

DarkHydrus

Description

DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. (Citation: Unit 42 DarkHydrus July 2018) (Citation: Unit 42 Playbook Dec 2017)

Techniques Used

DarkHydrus has obtained and used tools such as

Mimikatz,

Empire, and

Cobalt Strike.(Citation: Unit 42 DarkHydrus July 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

DarkHydrus has used

PowerShell windows. (Citation: Unit 42 DarkHydrus July 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.(Citation: Unit 42 DarkHydrus July 2018)(Citation: Unit 42 Playbook Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1187|Forced Authentication|

DarkHydrus used

Template Injection to launch an authentication window for users to enter their credentials.(Citation: Unit 42 Phishery Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1221|Template Injection|

DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable

Forced Authentication.(Citation: Unit 42 Phishery Aug 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|