Threats Feed

The RogueRobin malware, developed by the DarkHydrus group, employs DNS tunneling for covert communications in cyberattacks targeting government and educational institutions. The malware appears in two variants: a PowerShell and a .NET executable, both facilitating commands and control operations via encoded DNS queries. This series explores differences in their operation, emphasizing persistence methods and anti-analysis tactics. The technical nuances of RogueRobin, including its innovative DNS record types, highlight its role in sophisticated cyber espionage campaigns.

DarkHydrus, an adversary group operating primarily in the Middle East, has resumed activities with new tactics, tools, and procedures (TTPs). Recently analyzed by security researchers, the group has been deploying a new variant of the RogueRobin trojan, which now utilizes Google Drive API for command and control (C2) communications. This shift to using legitimate cloud services for C2 indicates an evolution in their operational tactics. The trojan, delivered through macro-enabled Excel documents, exhibits sophisticated evasion techniques, including environment checks and dynamic DNS to mask its C2 communications. The analysis revealed the use of typosquatting and open-source penetration testing tools, underscoring the group’s persistent and evolving threat landscape.

Palo Alto Unit42 documents DarkHydrus conducting credential harvesting attacks against government entities and educational institutions in the Middle East using the open-source Phishery tool, with the campaign active from at least September 2017 through June 2018. Phishery performs two functions: it injects a remote template URL into Word documents (using the Office attachedTemplate technique) and hosts a C2 server to capture credentials entered into the authentication dialog box that Microsoft Office automatically presents when attempting to load the remote template. DarkHydrus used three malicious Word documents in this campaign. The September 2017 document displayed an employee survey as the decoy, and the November 2017 document displayed what appeared to be an internal password handover form — suggesting the actor may have had prior access to the organization's internal materials. The June 2018 document was empty after credential theft. In all cases, when the user opened the document, Word displayed a dialog asking them to authenticate to connect to a remote resource. DarkHydrus' C2 domain 0utl00k[.]net was engineered to resemble Microsoft Outlook's legitimate "outlook.com" domain. For the June 2018 attack, the specific subdomain used matched the name of the targeted educational institution — making the dialog appear to be an internal login prompt — significantly increasing the likelihood of credential submission. Unit42 confirmed DarkHydrus used Phishery by recreating the tool's output and matching the remote template path exactly, then successfully capturing test credentials via the same C2 flow. The use of an open-source tool is consistent with DarkHydrus's broader pattern of leveraging freely available offensive tools rather than developing custom malware.