New DarkHydrus threat group targets Middle Eastern government agency

guest · Jul 30, 2018

New DarkHydrus threat group targets Middle Eastern government agency
July 30, 2018
https://www.scmagazine.com/new-dark...dle-eastern-government-agency/article/784461/

A new threat group dubbed DarkHydrus has targeted at least one government in the agency Middle East.

Between July 15-16, Palo Alto Network's Unit 42 researchers spotted the group using spear-phishing emails written in Arabic, to targeted organizations with password protected RAR archive attachments containing malicious Excel Web Query files or ".iqy" files, according to a July 27 blog post.

Researchers dubbed the custom PowerShell based payload, RogueRobin, and said it's possible the group pieced together the tool using code from legitimate open source tools.

The threat actors appear to have been active since 2016 as their most recent attacks has diverged from previous attacks witnessed by the researchers.
Click to expand...

EASTER · Jul 30, 2018

mood said: ↑

Researchers dubbed the custom PowerShell based payload, RogueRobin, and said it's possible the group pieced together the tool using code from legitimate open source tools.
Click to expand...

Don't they all. Leechers

guest · Aug 7, 2018

DarkHydrus using Phishery tool to harvest credentials
August 07, 2018
https://www.scmagazine.com/darkhydrus-using-phishery-tool-to-harvest-credentials/article/786705/

The recently discovered DarkHydrus threat group is now using the open-source Phishery tool to harvest credentials from an educational institution in the Middle East.

On June 24, researchers from Palo Alto's Unit 42 division observed the threat group carrying out an attack using a spear phishing email with the subject line reading “Project Offer” and a malicious word attachment, according to an Aug. 7, 2018 company blog post.

"The credential harvesting attacks used spear phishing emails that contained malicious Microsoft Office documents that leveraged the 'attachedTemplate' technique to load a template from a remote server," researchers said in the post.
Click to expand...

guest · Jan 19, 2019

DarkHydrus delivers new Trojan that can use Google Drive for C2 communications
January 18, 2019
https://unit42.paloaltonetworks.com...t-can-use-google-drive-for-c2-communications/

Since that initial reporting, we had not observed new activity from DarkHydrus until recently, when 360TIC published a tweet and subsequent research discussing delivery documents that appeared to be attributed to DarkHydrus
Using Google Drive for C2
A command that was not available in the original PowerShell variant of RogueRobin but is available with the new C# variant is the x_mode. This command is particularly interesting as it enables an alternative command and control channel that uses the Google Drive API.
Conclusion
The DarkHydrus group continues their operations and adds new techniques to their playbook. Recent DarkHydrus delivery documents revealed the group abusing open-source penetration testing techniques such as the AppLocker bypass.
Lastly, the new variant of RogueRobin is capable of using the Google Drive cloud service for its C2 channel, suggesting that DarkHydrus may be shifting to abusing legitimate cloud services for their infrastructure.
Click to expand...

Log in or Sign up

New DarkHydrus threat group targets Middle Eastern government agency

guest Guest

EASTER Registered Member

guest Guest

guest Guest

Log in or Sign up

New DarkHydrus threat group targets Middle Eastern government agency

guest Guest

EASTER Registered Member

guest Guest

guest Guest

Useful Searches