Threat intelligence / Malware

Hydraq

[Hydraq](https://attack.mitre.org/software/S0203) is a data-theft trojan first used by [Elderwood](https://attack.mitre.org/groups/G0066) in the 2009 Google intrusion known as Operation Aurora, though variations of this trojan have been used in more recent campaigns by other Chinese actors, possibly including [APT17](https://attack.mitre.org/groups/G0025).(Citation: MicroFocus 9002 Aug 2016)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: ASERT Seven Pointed Dagger Aug 2015)(Citation: FireEye DeputyDog 9002 November 2013)(Citation: ProofPoint GoT 9002 Aug 2017)(Citation: FireEye Sunshop Campaign May 2013)(Citation: PaloAlto 3102 Sept 2015)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Labels

malware

21 recorded

Relationships

uses

from Axiom

Group

uses

from Elderwood

Group

uses

to Access Token Manipulation

Technique

uses

to Clear Windows Event Logs

Technique

uses

to Data from Local System

Technique

uses

to Exfiltration Over Alternative Protocol

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Modify Registry

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Query Registry

Technique

uses

to Screen Capture

Technique

uses

to Service Execution

Technique

uses

to Shared Modules

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Windows Service

Technique

20 external

References

mitre-attack

S0203

open

9002 RAT

—

Roarur

—

MdmBot

—

HomeUnix

—

Homux

—

HidraQ

—

HydraQ

—

McRat

—

Hydraq

—

Aurora

—

ASERT Seven Pointed Dagger Aug 2015

https://www.arbornetworks.com/blog/asert/wp-content/uploads/2016/01/ASERT-Threat-Intelligence-Brief-2015-08-Uncovering-the-Seven-Point-Dagger.pdf

open

PaloAlto 3102 Sept 2015

https://researchcenter.paloaltonetworks.com/2015/09/chinese-actors-use-3102-malware-in-attacks-on-us-government-and-eu-media/

open

ProofPoint GoT 9002 Aug 2017

https://www.proofpoint.com/us/threat-insight/post/operation-rat-cook-chinese-apt-actors-use-fake-game-thrones-leaks-lures

open

FireEye Sunshop Campaign May 2013

https://web.archive.org/web/20200302085651/https://www.fireeye.com/blog/threat-research/2013/05/ready-for-summer-the-sunshop-campaign.html

open

FireEye DeputyDog 9002 November 2013

https://web.archive.org/web/20190221032148/http://www.fireeye.com/blog/threat-research/2013/11/operation-ephemeral-hydra-ie-zero-day-linked-to-deputydog-uses-diskless-method.html

open

Novetta-Axiom

https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf

open

Symantec Elderwood Sept 2012

https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf

open

MicroFocus 9002 Aug 2016

https://community.softwaregrp.com/t5/Security-Research/9002-RAT-a-second-building-on-the-left/ba-p/228686#.WosBVKjwZPZ

open

Symantec Trojan.Hydraq Jan 2010

https://www.symantec.com/connect/blogs/trojanhydraq-incident

open