MITRE ATT&CKsoftware (malware)

S9013 DRYHOOK

Published 2026-04-14 Modified 2026-04-23 Official page ↗
Domain
enterprise
Platforms
Linux, Network Devices
Version
1.0
Created
2026-04-14

Description

DRYHOOK is Python script used to steal credentials. DRYHOOK was first reported in January 2025, and has previously been leveraged by People's Republic of China (PRC) state-affiliated threat actors identified as UNC5221 and SYLVANITE.

Related

Uses · MITRE ATT&CK (11)

  • T1685 Disable or Modify Tools technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1059.008 Network Device CLI sub-technique
  • T1556.004 Network Device Authentication sub-technique
  • T1601 Modify System Image technique
  • T1074.001 Local Data Staging sub-technique
  • T1059.006 Python sub-technique
  • T1056.001 Keylogging sub-technique
  • T1556 Modify Authentication Process technique
  • T1222.002 Linux and Mac Permissions sub-technique
  • T1489 Service Stop technique

References