H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[RogueRobin](https://attack.mitre.org/software/S0270) is a payload used by [DarkHydrus](https://attack.mitre.org/groups/G0079) that has been developed in PowerShell and C#. (Citation: Unit 42 DarkHydrus July 2018)(Citation: Unit42 DarkHydrus Jan 2019)

Labels

malware

19 recorded

Relationships

uses

from DarkHydrus

Group

uses

to Bidirectional Communication

Technique

uses

to Command Obfuscation

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to Shortcut Modification

Technique

uses

to Standard Encoding

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

4 external

References

mitre-attack

S0270

RogueRobin

—

Unit 42 DarkHydrus July 2018

https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

Unit42 DarkHydrus Jan 2019

https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/