Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Dark Hydrus Uses Phishery to Harvest Credentials in the Middle East

Summary: Unit 42 reported that a threat group it named DarkHydrus used spear-phishing emails with malicious Microsoft Word documents to harvest credentials from government entities and educational institutions in the Middle East, with activity observed as recently as June 24, 2018, and related documents dating to September and November 2017. The documents used the attachedTemplate technique to load a remote template, prompting a Microsoft Office authentication dialog that sent entered credentials to a command-and-control server on the lookalike domain 0utl00k[.]net, and Unit 42 confirmed two of the three known documents were built with the open-source Phishery tool.

Bottom line: The June 2018 document displayed an empty page after the prompt, and the C2 subdomain was set to the targeted institution's own domain name, so a user typing Windows credentials out of habit handed them over with nothing to show for it. Unit 42 assesses the group will likely continue attacking these Middle East targets in the near future, and it built the campaign on a free open-source tool rather than custom malware.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Phishing & Social Engineering
Related