aol.pm

Hydraq

Software · ATTACK:enterprise:S0203

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0203",
  "title": "Hydraq",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0203",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--73a4793a-ce55-4159-b2a6-208ef29b326f",
  "external_id": "S0203",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2024-11-17T19:55:07.589Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "9002 RAT"
    },
    {
      "source_name": "Roarur"
    },
    {
      "source_name": "MdmBot"
    },
    {
      "source_name": "HomeUnix"
    },
    {
      "source_name": "Homux"
    },
    {
      "source_name": "HidraQ"
    },
    {
      "source_name": "HydraQ"
    },
    {
      "source_name": "McRat"
    },
    {
      "source_name": "Hydraq"
    },
    {
      "source_name": "Aurora"
    },
    {
      "source_name": "ASERT Seven Pointed Dagger Aug 2015",
      "url": "https://www.arbornetworks.com/blog/asert/wp-content/uploads/2016/01/ASERT-Threat-Intelligence-Brief-2015-08-Uncovering-the-Seven-Point-Dagger.pdf"
    },
    {
      "source_name": "PaloAlto 3102 Sept 2015",
      "url": "https://researchcenter.paloaltonetworks.com/2015/09/chinese-actors-use-3102-malware-in-attacks-on-us-government-and-eu-media/"
    },
    {
      "source_name": "ProofPoint GoT 9002 Aug 2017",
      "url": "https://www.proofpoint.com/us/threat-insight/post/operation-rat-cook-chinese-apt-actors-use-fake-game-thrones-leaks-lures"
    },
    {
      "source_name": "FireEye Sunshop Campaign May 2013",
      "url": "https://web.archive.org/web/20200302085651/https://www.fireeye.com/blog/threat-research/2013/05/ready-for-summer-the-sunshop-campaign.html"
    },
    {
      "source_name": "FireEye DeputyDog 9002 November 2013",
      "url": "https://web.archive.org/web/20190221032148/http://www.fireeye.com/blog/threat-research/2013/11/operation-ephemeral-hydra-ie-zero-day-linked-to-deputydog-uses-diskless-method.html"
    },
    {
      "source_name": "Novetta-Axiom",
      "url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
    },
    {
      "source_name": "Symantec Elderwood Sept 2012",
      "url": "https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
    },
    {
      "source_name": "MicroFocus 9002 Aug 2016",
      "url": "https://community.softwaregrp.com/t5/Security-Research/9002-RAT-a-second-building-on-the-left/ba-p/228686#.WosBVKjwZPZ"
    },
    {
      "source_name": "Symantec Trojan.Hydraq Jan 2010",
      "url": "https://www.symantec.com/connect/blogs/trojanhydraq-incident"
    }
  ]
}

Explicit source assertions (21)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0825b101-deff-45cf-867c-af3ccb233744

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15455c48-f71c-480d-91b8-e41f12608705

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c0e8084-c8a5-4c8d-bac1-bfb7eb07b586

Symantec Hydraq Persistence Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c52b081-7521-4b73-8603-e6d05496db0c

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a851ebf-c021-4ab1-a02f-84b03d65fdda

Symantec Elderwood Sept 2012

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4be87979-faf9-4a7a-998a-d1aa3fbf5a80

Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5073b1b4-4018-4208-a46e-86a8358a6cee

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--541855dd-0249-4f63-8e95-0024f760484e

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d914544-0a93-43ba-b890-1f4a4fa818e8

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ef1c7d8-70bc-4634-b705-644f4d1db3b0

Symantec Elderwood Sept 2012 · Symantec Trojan.Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72e36412-4427-479b-bc8e-e8d53e997587

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010 · Symantec Hydraq Persistence Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73ba3a26-5a77-4c3a-aea7-5ea8de846b75

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7feb6ceb-8a7c-45a9-902a-9b9c2c9a5e2c

Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--935f8b6e-cd74-46c4-9a74-f763b4f13955

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c7a7eca-b91a-4974-bcf0-cfb77f105abd

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a69bd4c0-ddaa-4dec-a35d-b067ae1d95fc

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a883e4c6-6a40-4660-9120-b2430099ccb6

Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1048

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5a0e330-ec5a-49cc-95b8-b7a5c49bd500

Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7fee556-41c2-43bd-a732-e11ff34fb129

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d68ff9e8-0766-49ea-8ddc-4308347c5bac

Symantec Hydraq Jan 2010

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0094ba8-a513-49bf-a5d7-961aaab13380

Cisco Group 72 · Novetta-Axiom

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.