DarkHydrus Exploits Open-Source Tools in Cyberattacks Against Middle Eastern Governments and Academia

Palo Alto Unit42 documented a credential harvesting campaign by DarkHydrus targeting government and educational institutions in the Middle East. Attackers sent spearphishing emails with malicious Word documents that, when opened, automatically triggered an authentication prompt asking the user to log in — sending whatever credentials they entered to an attacker-controlled server. The campaign ran from at least September 2017 through June 2018 and used an open-source tool called Phishery to create the malicious documents and capture stolen credentials.

The attacks are attributed to DarkHydrus, a threat group named by Palo Alto Unit42 in July 2018. The group targets Middle Eastern government and academic organizations and is notable for its consistent use of open-source offensive tools rather than custom malware. DarkHydrus is assessed to be an Iranian-linked threat actor based on targeting patterns and infrastructure overlaps with other Iranian-linked groups. This Phishery campaign was discovered in the same period as their RogueRobin backdoor operations against the same target set.

The goal was credential theft — specifically Windows account credentials from employees at targeted Middle Eastern government and educational organizations. Once stolen, these credentials could be used for further access into those organizations' networks, email systems, or internal resources. DarkHydrus did not deploy malware or destructive payloads in this campaign; the entire operation was focused on silently harvesting login credentials through social engineering.

The campaign ran for at least nine months — from September 2017 through June 2018 — targeting government entities and educational institutions in the Middle East. Three separate credential harvesting documents are documented across that period. The targeting is consistent with DarkHydrus's concurrent RogueRobin backdoor operations, suggesting this credential harvesting campaign was one component of a broader, sustained espionage effort against the same target set.

Confirmed targets include government agencies and educational institutions in the Middle East. The June 2018 attack hit an educational institution directly; the September and November 2017 documents appear tailored for specific organizations — the survey decoy and the internal-looking password handover form both suggest the attacker had some familiarity with the target environment. The consistent targeting of both government and academic sectors across this and DarkHydrus's other campaigns indicates these two sectors are the group's primary focus.

The attacker sent a spearphishing email with a malicious Word document. When the victim opened the document, Microsoft Office automatically tried to load a template from a remote URL embedded in the file. This triggered an authentication dialog box — a standard Windows prompt — asking the user to log in. The domain shown in the dialog was designed to look like Outlook.com or the user's own organization. If the user entered their Windows credentials and clicked OK, those credentials were sent directly to the attacker's Phishery C2 server. The document then displayed apparently legitimate-looking content, leaving the victim unaware that anything had happened.

Middle Eastern government and academic organizations hold sensitive information relevant to Iranian state interests — diplomatic communications, research, personnel records, and network credentials that can enable further access. DarkHydrus's use of credential harvesting alongside their RogueRobin backdoor campaigns suggests a two-track approach: stolen credentials for direct network access, and backdoor implants for persistent covert presence. Universities are also targeted as softer entry points — they often have less mature security controls than government ministries while employing researchers and officials with cross-sector access.