New Threat Actor Group Dark Hydrus Targets Middle East Government
Summary: Unit 42 analyzed a July 2018 spear-phishing attack against at least one Middle East government agency, carried out by a previously unpublished group it tracks as DarkHydrus, which has operated with its current playbook since early 2016. The emails, sent July 15-16 in Arabic with the password 123456, carried a password-protected credential.rar containing an Excel Web Query (.iqy) file that pulled a PowerShell payload Unit 42 calls RogueRobin, which checks for sandbox environments, installs itself via %APPDATA%\OneDrive.ps1 and a startup shortcut, and communicates with command-and-control servers over a custom DNS tunneling protocol.
Why it matters: The payload reached its C2 through DNS queries built from nslookup and crafted subdomains, and the C2 domains spoofed security vendors while resolving to IPs in a Chinese service provider's 1.2.9.0/24 range - traffic most organizations' web and proxy controls never inspect.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026