APT / THREAT GROUP

DarkHydrus

aliases

Last seen:Mar 17, 2026

Intelligence Profile

[DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. (Citation: Unit 42 DarkHydrus July 2018) (Citation: Unit 42 Playbook Dec 2017)

Threat Analysis

DarkHydrus is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

→https://mobile.twitter.com/360TIC/status/1083289987339042817

→https://ti.360.net/blog/articles/latest-target-attack-of-darkhydruns-group-against-middle-east-en/

→https://unit42.paloaltonetworks.com/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/

→https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/

→https://attack.mitre.org/groups/G0079/

→https://unit42.paloaltonetworks.com/atoms/obscureserpens/

Quick Facts

TypeAPT / Threat Group

Aliases4

SourceMalpedia

Also Known As

Obscure SerpensDarkHydrusLazyMeerkatG0079

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search DarkHydrus