- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2016–2026
- Status
- Active
- ATT&CK
- G0079 · 7 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0062 · darkhydrus
IranWhat it is
DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0079
- Thales
- ATK77
- Other names
- ATK 77, DarkHydrus, LazyMeerkat, Hive0075, LazyMeerkat, Obscure Serpens
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Iran
- Sectors
- Education, Government
Tools
The tools and malware families the sources tie to it.
- Cobalt Strike
- Mimikatz
- Phishery
- RogueRobin
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de