Hydrochasma

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries 1

Countries highlighted in red

American Samoa

Sectors Targeted

Public Administration 92 Government Health Care and Social Assistance 62 Chemical Manufacturing 325 Food Manufacturing 311 Shipping and Logistics Utilities 22 NAICS:48 48 Water Transportation 483 Information 51 Accommodation 721 Healthcare Accommodation and Food Services 72

Details

Last Updated 11 May 2024

MITRE ATT&CK 5

T1027.002 T1071.001 T1078.003 T1105 T1566.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

Hydrochasma Symantec

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Asia

Description

(Symantec) Shipping companies and medical laboratories in Asia are being targeted in a likely intelligence-gathering campaign that relies exclusively on publicly available and living-off-the-land tools. Hydrochasma, the threat actor behind this campaign, has not been linked to any previously identified group, but appears to have a possible interest in industries that may be involved in COVID-19-related treatments or vaccines. This activity has been ongoing since at least October 2022. While Symantec, by Broadcom Software, did not see any data being exfiltrated in this campaign, the targets, as well as some of the tools used, indicate that the most likely motivation in this campaign is intelligence gathering.

Tools Used 7

BrowserGhost Cobalt Strike GO Simple Tunnel HackBrowserData ProcDump SoftEther VPN Living off the Land

Reports & References 1

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/hydrochasma-asia-medical-shipping-intelligence-gathering

ETDA Profile

Hydrochasma

Origin

[Unknown]

First Seen 2022

Motivation

Information theft and espionage

View on ETDA APT Groups ↗