Unlike the June 2018 document that displayed no content after credential theft, both of these documents displayed content that appears pertinent to the targeted organization The September 2017 document displays an employee survey, which can be seen in Figure 2 We were unable to find the displayed document via open source research, which may suggest that the actor gathered this password handover form from a prior operation This same infrastructure was discussed in the Campaign Analysis of our previous blog Phishery Tool While analyzing the three malicious Word documents, we determined that two of the documents were created using an open source tool called Phishery The Phishery tool is capable of the following:  Creating malicious Word documents by injecting a remote template URL Hosting a C2 server to gather credentials entered into authentication dialog boxes displayed when attempting to obtain the remote template  We were able to confirm that DarkHydrus used Phishery to create these Word documents by using the open source tool to create a document and host a C2 ourselves The DarkHydrus document used in the June 2018 attacks had a remote template URL added, as seen in Figure 4 Figure 4 Remote template URL seen in the DarkHydrus document from June 2018 We were able to replicate the remote template path seen in Figure 4 by using Phishery to create a weaponized delivery document Figure 5 Phishery command used to create a document that has same remote template URL as DarkHydrus To confirm, we used Phishery’s C2 server and opened DarkHydrus’ Word document from the June 2018 attacks When presented with the authentication dialog box, we entered “fakename” and “fakepass” as credentials, as seen in Figure 6 and pressed enter The C2 server was able to obtain the “fakename” and “fakepass” credentials entered into the authentication dialog box displayed when opening DarkHydrus’ Word document Figure 7 Output of Phishery C2 showing captured credentials Conclusion DarkHydrus is a threat group carrying out attack campaigns targeting organizations in the Middle East We discovered DarkHydrus carrying out credential harvesting attacks that use weaponized Word documents, which they delivered via spear-phishing emails to entities within government and educational institutions This threat group not only used the Phishery tool to create these malicious Word documents, but also to host the C2 server to harvest credentials The use of Phishery further shows Dark Hydrus’ reliance on open source tools to conduct their operations Palo Alto Networks customers are protected from Dark Hydrus by:  The C2 server 0utl00k[.]net is classified as Malware All Phishery documents created by DarkHydrus have malicious verdicts in WildFire AutoFocus customers can monitor this threat group’s activity via the DarkHydrus tag    Indicators of Compromise Samples d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318 9eac37a5c675cd1750cd50b01fc05085ce0092a19ba97026292a60b11b45bf49 0b1d5e17443f0896c959d22fa15dadcae5ab083a35b3ff6cb48c7f967649ec82   Infrastructure 0utl00k[.]net 107.175.150[.]113 195.154.41[.]150 The post DarkHydrus Uses Phishery to Harvest Credentials in the Middle East appeared first on Palo Alto Networks Blog 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unlike the June 2018 document that displayed no content after credential theft, both of these documents displayed content that appears pertinent to the targeted organization The September 2017 document displays an employee survey, which can be seen in Figure 2 We were unable to find the displayed document via open source research, which may suggest that the actor gathered this password handover form from a prior operation This same infrastructure was discussed in the Campaign Analysis of our previous blog Phishery Tool While analyzing the three malicious Word documents, we determined that two of the documents were created using an open source tool called Phishery The Phishery tool is capable of the following:  Creating malicious Word documents by injecting a remote template URL Hosting a C2 server to gather credentials entered into authentication dialog boxes displayed when attempting to obtain the remote template  We were able to confirm that DarkHydrus used Phishery to create these Word documents by using the open source tool to create a document and host a C2 ourselves The DarkHydrus document used in the June 2018 attacks had a remote template URL added, as seen in Figure 4 Figure 4 Remote template URL seen in the DarkHydrus document from June 2018 We were able to replicate the remote template path seen in Figure 4 by using Phishery to create a weaponized delivery document Figure 5 Phishery command used to create a document that has same remote template URL as DarkHydrus To confirm, we used Phishery’s C2 server and opened DarkHydrus’ Word document from the June 2018 attacks When presented with the authentication dialog box, we entered “fakename” and “fakepass” as credentials, as seen in Figure 6 and pressed enter The C2 server was able to obtain the “fakename” and “fakepass” credentials entered into the authentication dialog box displayed when opening DarkHydrus’ Word document Figure 7 Output of Phishery C2 showing captured credentials Conclusion DarkHydrus is a threat group carrying out attack campaigns targeting organizations in the Middle East We discovered DarkHydrus carrying out credential harvesting attacks that use weaponized Word documents, which they delivered via spear-phishing emails to entities within government and educational institutions This threat group not only used the Phishery tool to create these malicious Word documents, but also to host the C2 server to harvest credentials The use of Phishery further shows Dark Hydrus’ reliance on open source tools to conduct their operations Palo Alto Networks customers are protected from Dark Hydrus by:  The C2 server 0utl00k[.]net is classified as Malware All Phishery documents created by DarkHydrus have malicious verdicts in WildFire AutoFocus customers can monitor this threat group’s activity via the DarkHydrus tag    Indicators of Compromise Samples d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318 9eac37a5c675cd1750cd50b01fc05085ce0092a19ba97026292a60b11b45bf49 0b1d5e17443f0896c959d22fa15dadcae5ab083a35b3ff6cb48c7f967649ec82   Infrastructure 0utl00k[.]net 107.175.150[.]113 195.154.41[.]150 The post DarkHydrus Uses Phishery to Harvest Credentials in the Middle East appeared first on Palo Alto Networks Blog  ### Response: .