Loading threat actor…
Hydrochasma is a threat cluster active since at least October 2022 that has conducted apparent intelligence-gathering intrusions against shipping companies and medical laboratories in Asia, including organizations potentially involved in COVID-19 treatments or vaccine-related research. The activity has not been conclusively linked to any previously identified intrusion set. Operations appear to begin with phishing-based initial access using lure executables disguised as benign documents, followed by extensive use of living-off-the-land techniques and publicly available offensive tooling rather than bespoke malware, a tradecraft pattern that supports stealth and complicates attribution. Observed post-compromise activity includes deployment of FRP for remote access, Meterpreter and Cobalt Strike for command execution and post-exploitation, credential dumping with tools such as Procdump, theft of browser-stored credentials and data, network scanning and reconnaissance with multiple utilities, tunneling and proxying, NTLM relay activity, and persistence via scheduled tasks. The toolset and sequencing indicate objectives consistent with persistent access, privilege escalation, lateral movement, credential theft, and internal intelligence collection. Although confirmed data exfiltration was not observed in the investigated intrusions, the victimology and operational behavior are consistent with espionage-oriented collection requirements. Hydrochasma has been described as showing interest in maritime and medical research targets in Asia, particularly where those organizations may intersect with strategic supply chains or COVID-19-related research.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
71 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hydrochasma is a China-nexus threat actor targeting shipping and medical research organizations in Asia, likely for intelligence and IP theft.
Likely intelligence-gathering campaign targeting shipping companies and medical laboratories in Asia using phishing for initial access and relying almost entirely on publicly available and living-off-the-land tools for persistence, credential access, lateral movement, and remote access.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.