File · DarkHydrus · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

DarkHydrus

LazyMeerkat
G0079
Obscure Serpens

attack rose · 7 techniques across 5 tactics

Analyst brief

misp-galaxy + mitre-attack

In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy).

Kill chain

MITRE ATT&CK Enterprise · tap a technique

7 techniques · 5 of 15 tactics

Matters for

Resource development
1 technique
Initial access
1 technique
Execution
2 techniques
Stealth
2 techniques
Credential access
1 technique

select a technique

Arsenal

2 malware · 1 tools

Malware
Malware · 2	ATT&CK	Shared by
RogueRobin	S0270 ↗
Cobalt Strike	S0154 ↗	24 actors

Tools
Tools · 1	ATT&CK	Shared by
Mimikatz	S0002 ↗	49 actors

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

9 sources

Track DarkHydrus on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Analyst brief

Kill chain

Resource development

Initial access

Execution

Stealth

Credential access

Arsenal

Take it with you

References

Track DarkHydrus on the wire.