DarkHydrus__2019__New_Threat_Actor_Group_DarkHydrus_Targets_Middle_East_Government.pdf

Unit 42 analyzed a targeted DarkHydrus campaign (July 2018) that delivered password-protected RAR attachments containing malicious .iqy Excel Web Query files which cause Excel to fetch and execute a PowerShell backdoor (RogueRobin). The backdoor performs sandbox detection, installs persistence via %APPDATA%\OneDrive.ps1/OneDrive.lnk, and communicates with C2 servers using a custom DNS-tunneling protocol across multiple vendor‑spoofing domains; the report provides extensive IOCs (domains and SHA256 hashes), technical TTPs, and mitigation notes.