Article Content Last week, Unit 42 released a blog on a newly named threat group called DarkHydrus that we observed targeting government entities in the Middle East The attack that we discussed in our previous publication involved spear-phishing to deliver a PowerShell payload we call RogueRobin; however, we are aware of DarkHydrus carrying out a credential harvesting attack in June 2018 It also appears that this an ongoing campaign, as we have evidence of previous credential harvesting attempts using the same infrastructure dating back to the Fall of 2017 These attacks were targeting government entities and educational institutions in the Middle East When attempting to load this remote template, Microsoft Office will display an authentication dialog box to ask the user to provide login credentials Based on Unit 42’s analysis, DarkHydrus used the open-source Phishery tool to create two of the known Word documents used in these credential harvesting attacks As discussed in our previous blog, this further strengthens DarkHydrus’ use of the open source for their attack tools A phishing attack to steal credentials like this is not new: US-CERT warned of the same technique by a different threat group in 2017 What is noteworthy is DarkHydrus’ use of an open-source tool to carry out targeted attacks against these entities in the Middle East, which is fitting of their reliance of open source tools and these attacks are consistent in terms of targeting with what we reported last week Based on this, we can reasonably presume this group will continue to carry out attacks against these kinds of targets in the Middle East in the near-future When opened, the malicious Word document displays a dialog box that asks the user for their credentials, as seen in Figure 1 Figure 1 Authentication dialog box presented to the user when opening document As you can see in Figure 1, the authentication prompt says “Connecting to <redacted> 0utl00k[.]net”, which is a DarkHydrus C2 server If the user enters their credentials in this dialog box and presses ‘Ok’, the credentials are sent to the C2 server via the URL https://<redacted>.0utl00k[.]net/download/template.docx With the authentication dialog box gone, Word displays the contents of the document, which in this specific case was an empty document While this document was empty, the authentication prompt may have made the targeted user more likely to enter their credentials, thinking it’s necessary to view the contents of the document DarkHydrus also created their C2 domain carefully in an attempt to further trick the targeted user to enter their credentials Firstly, the redacted subdomain was the domain of the targeted educational institution Also, the 0utl00k[.]net domain resembles Microsoft’s legitimate “outlook.com” domain that provides free email services, which also make the user less suspicious and more likely to enter their credentials Some users may not even notice what domain the dialog states they are connecting to and habitually type their Windows credentials We found two additional Word documents using the 0utl00k[.]net domain to harvest credentials, seen in Table 1 We first saw these related Word documents in September and November 2017, which suggests that DarkHydrus has been carrying out this credential harvesting campaign for almost a year First Seen SHA256 Filename Remote Template   11/12/2017 9eac37a5c6
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Last week, Unit 42 released a blog on a newly named threat group called DarkHydrus that we observed targeting government entities in the Middle East The attack that we discussed in our previous publication involved spear-phishing to deliver a PowerShell payload we call RogueRobin; however, we are aware of DarkHydrus carrying out a credential harvesting attack in June 2018 It also appears that this an ongoing campaign, as we have evidence of previous credential harvesting attempts using the same infrastructure dating back to the Fall of 2017 These attacks were targeting government entities and educational institutions in the Middle East When attempting to load this remote template, Microsoft Office will display an authentication dialog box to ask the user to provide login credentials Based on Unit 42’s analysis, DarkHydrus used the open-source Phishery tool to create two of the known Word documents used in these credential harvesting attacks As discussed in our previous blog, this further strengthens DarkHydrus’ use of the open source for their attack tools A phishing attack to steal credentials like this is not new: US-CERT warned of the same technique by a different threat group in 2017 What is noteworthy is DarkHydrus’ use of an open-source tool to carry out targeted attacks against these entities in the Middle East, which is fitting of their reliance of open source tools and these attacks are consistent in terms of targeting with what we reported last week Based on this, we can reasonably presume this group will continue to carry out attacks against these kinds of targets in the Middle East in the near-future When opened, the malicious Word document displays a dialog box that asks the user for their credentials, as seen in Figure 1 Figure 1 Authentication dialog box presented to the user when opening document As you can see in Figure 1, the authentication prompt says “Connecting to <redacted> 0utl00k[.]net”, which is a DarkHydrus C2 server If the user enters their credentials in this dialog box and presses ‘Ok’, the credentials are sent to the C2 server via the URL https://<redacted>.0utl00k[.]net/download/template.docx With the authentication dialog box gone, Word displays the contents of the document, which in this specific case was an empty document While this document was empty, the authentication prompt may have made the targeted user more likely to enter their credentials, thinking it’s necessary to view the contents of the document DarkHydrus also created their C2 domain carefully in an attempt to further trick the targeted user to enter their credentials Firstly, the redacted subdomain was the domain of the targeted educational institution Also, the 0utl00k[.]net domain resembles Microsoft’s legitimate “outlook.com” domain that provides free email services, which also make the user less suspicious and more likely to enter their credentials Some users may not even notice what domain the dialog states they are connecting to and habitually type their Windows credentials We found two additional Word documents using the 0utl00k[.]net domain to harvest credentials, seen in Table 1 We first saw these related Word documents in September and November 2017, which suggests that DarkHydrus has been carrying out this credential harvesting campaign for almost a year First Seen SHA256 Filename Remote Template   11/12/2017 9eac37a5c6 ### Response: .