DarkHydrus is a cyber espionage threat group that emerged in 2016, primarily targeting government agencies and educational institutions within the Middle East. The group is assessed with high confidence to be Iranian state-sponsored, with a primary motivation of information theft and intelligence gathering to support regional security and political objectives. DarkHydrus is distinguished by its consistent and heavy reliance on open-source tools for its operations, alongside custom payloads like the RogueRobin trojan, which evolved from PowerShell-based to C#-based. The group has also uniquely adopted legitimate cloud services, specifically Google Drive, for command and control communications, allowing it to blend in with normal network traffic and complicate detection. DarkHydrus is also tracked under the aliases G0079 by MITRE, LazyMeerkat by Kaspersky, Obscure Serpens by Palo Alto, and ATK 77 by Thales. While some reports suggest overlaps with other groups like APT19 or Deep Panda, d

Aliases del actor

G0079LazyMeerkatObscure SerpensAPT DARKHYDRUSG0052incluyendo actividades relacionadas con espionajebrechas de seguridadRogueRobinplataformas como researchcenter

Actores similares

apt-darkhydrusactor · 1apt-desertfalconactor · 1apt-stealthfalconactor · 1apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2apt-c-12actor · 1apt-18actor · 1apt-1877teamactor · 1apt-27actor · 1