Threat intelligence / Malware

DRYHOOK

[DRYHOOK](https://attack.mitre.org/software/S9013) is Python script used to steal credentials. [DRYHOOK](https://attack.mitre.org/software/S9013) was first reported in January 2025, and has previously been leveraged by People's Republic of China (PRC) state-affiliated threat actors identified as UNC5221 and SYLVANITE.(Citation: Dragos SYLVANITE MuddyWater Electrum March 2026)(Citation: Google UNC5221 Ivanti January 2025)(Citation: Picus Security UNC5221 Ivanti May 2025)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[DRYHOOK](https://attack.mitre.org/software/S9013) is Python script used to steal credentials. [DRYHOOK](https://attack.mitre.org/software/S9013) was first reported in January 2025, and has previously been leveraged by People's Republic of China (PRC) state-affiliated threat actors identified as UNC5221 and SYLVANITE.(Citation: Dragos SYLVANITE MuddyWater Electrum March 2026)(Citation: Google UNC5221 Ivanti January 2025)(Citation: Picus Security UNC5221 Ivanti May 2025)

Labels

malware

11 recorded

Relationships

uses

to Disable or Modify Tools

Technique

uses

to Encrypted/Encoded File

Technique

uses

Technique

uses

to Linux and Mac Permissions

Technique

uses

to Local Data Staging

Technique

uses

to Modify Authentication Process

Technique

uses

to Modify System Image

Technique

uses

to Network Device Authentication

Technique

uses

to Network Device CLI

Technique

uses

Technique

uses

to Service Stop

Technique

4 external

References

mitre-attack

S9013

Dragos SYLVANITE MuddyWater Electrum March 2026

https://hub.dragos.com/hubfs/2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=en

Google UNC5221 Ivanti January 2025

https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day

Picus Security UNC5221 Ivanti May 2025

https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure