PhantomControl

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries

No target country recorded

Sectors Targeted

No targeted sector recorded

Details

Origin 🇮🇷 IR

Last Updated 13 Jan 2024

MITRE ATT&CK 15

T1059 T1059.001 T1071.001 T1187 T1204 T1204.002 T1221 T1548.002 T1564 T1564.003 T1566 T1566.001 T1574 T1588 T1588.002

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 5 entries

DarkHydrus Palo Alto

LazyMeerkat Kaspersky

ATK 77 Thales

Obscure Serpens Palo Alto

G0079 MITRE

Observed Target Countries 2

Based on ETDA data — countries highlighted in red

Iran Middle East

Description

DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. Some analysts track Dark Hydrus, {{APT 19, Deep Panda, C0d0so0}} and {{Turbine Panda, APT 26, Shell Crew, WebMasters, KungFu Kittens}} as the same group, but it is unclear from open source information if the groups are the same.

Tools Used 4

Cobalt Strike Mimikatz Phishery RogueRobin

Operations 3

2018-06 On June 24, 2018, Unit 42 observed DarkHydrus carrying out a credential harvesting attack on an educational institution in the Middle East. The attack involved a spear-phishing email with a subject of “Project Offer” and a malicious Word document as an attachment. https://unit42.paloaltonetworks.com/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/

2018-07 Attack on Middle East Government This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy). https://unit42.paloaltonetworks.com/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

2019-01 New Attacks in the Middle East 360 Threat Intelligence Center captured several lure Excel documents written in Arabic in January 9, 2019. A backdoor dropped by macro in the lure documents can communicate with C2 server through DNS tunnel, as well as Google Drive API. https://ti.360.net/blog/articles/latest-target-attack-of-darkhydruns-group-against-middle-east-en/ https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/

Reports & References 1

https://unit42.paloaltonetworks.com/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

ETDA Profile

DarkHydrus, LazyMeerkat

Origin

Iran

First Seen 2016

Sponsor State-sponsored

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0079/

View on ETDA APT Groups ↗