MITRE ATT&CKgroup
G0079 DarkHydrus
- Domain
- enterprise
- Version
- 1.3
- Created
- 2018-10-17
Description
DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks.
Related
Uses · MITRE ATT&CK (10)
- T1588.002 Tool sub-technique
- T1564.003 Hidden Window sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- S0270 RogueRobin software (malware)
- T1221 Template Injection technique
- T1187 Forced Authentication technique
- S0154 Cobalt Strike software (malware)
- S0002 Mimikatz software (tool)
References
- https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/ Unit 42 DarkHydrus July 2018
- https://pan-unit42.github.io/playbook_viewer/ Unit 42 Playbook Dec 2017