DarkHydrus

DarkHydrus, also tracked as Lazy Meerkat, is an Iranian-linked advanced persistent threat group conducting cyberespionage against government agencies and educational institutions in the Middle East. Active since at least 2017, it uses targeted spearphishing, credential harvesting, and remote-access malware to compromise politically valuable organizations. Its initial-access techniques include password-protected RAR attachments containing malicious Excel Web Query files, macro-enabled Excel documents, and Microsoft Office documents that load attacker-controlled remote templates through the attachedTemplate mechanism. These attacks rely on recipients opening attachments or enabling content. The group uses PowerShell to download and execute additional scripts, conceals PowerShell windows, and has obtained and used Mimikatz, Empire, and Cobalt Strike. DarkHydrus deploys RogueRobin, a remote-access Trojan with PowerShell and compiled C#/.NET variants. RogueRobin uses DNS tunneling to receive tasks, execute commands, and return system information and command results. Its compiled variant also supports Google Drive as an alternative command-and-control channel that can be enabled remotely. Persistence mechanisms include Startup-folder shortcuts and user-level Run entries. The malware incorporates sandbox and virtual-machine checks, process inspection, obfuscation, and anti-debugging measures to hinder analysis and reduce detection.