H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Group

DarkHydrus

[DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. (Citation: Unit 42 DarkHydrus July 2018) (Citation: Unit 42 Playbook Dec 2017)

Group
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. (Citation: Unit 42 DarkHydrus July 2018) (Citation: Unit 42 Playbook Dec 2017)

10 recorded

Relationships

uses
to Cobalt Strike
Malware
uses
to Forced Authentication
Technique
uses
to Hidden Window
Technique
uses
to Malicious File
Technique
uses
to Mimikatz
Tool
uses
to PowerShell
Technique
uses
to RogueRobin
Malware
uses
to Spearphishing Attachment
Technique
uses
to Template Injection
Technique
uses
to Tool
Technique
4 external

References

mitre-attack
G0079
open
DarkHydrus
—
Unit 42 DarkHydrus July 2018
https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
open
Unit 42 Playbook Dec 2017
https://pan-unit42.github.io/playbook_viewer/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance