DarkHydrus
DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. [1] [2]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.[1][2] |
| Enterprise | T1187 | 强制身份验证 |
DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.[3] |
|
| Enterprise | T1221 | 模板注入 |
DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.[3] |
|
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.[1][2] |
| Enterprise | T1588 | .002 | 获取能力: Tool |
DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.[1] |
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the "attachedTemplate" technique to load a template from a remote server.[1][3][2] |
| Enterprise | T1564 | .003 | 隐藏伪装: Hidden Window |
DarkHydrus has used |