Hydrochasma

Threat Actor updated a month ago (2024-11-29T14:11:08.021Z)
Download STIX
Preview STIX
Hydrochasma, a previously unknown threat actor group, was discovered in February exploiting SoftEther VPN in a cyber-espionage campaign targeting Asia-based shipping companies. The group's operations were initially identified by researchers who noticed the presence of SoftEther VPN, a free, open-source VPN software often used by attackers, on the victim's network. Hydrochasma's primary method of initial access is through phishing, with a notable lure mimicking a resume for a "development engineer". Once inside a system, the attackers deploy a Fast Reverse Proxy, a tool capable of exposing a locally protected server to the internet. The group, named Hydrochasma by researchers at Symantec, a Broadcom Software-owned company, has yet to steal any data but appears to target industries involved in COVID-19-related treatments or vaccines for cyberespionage purposes. Initial signs of Hydrochasma’s presence on a targeted system are often indicated by the appearance of a lure document, designed to look like an email attachment written in the victim organization's native language. Notably, Hydrochasma employs open-source tools and Living off the Land (LotL) techniques during their attacks, making their activity more challenging to attribute and detect. Hydrochasma's use of open-source malware instead of custom malware is considered significant as it is relatively unusual for attack groups. The infection vector used by Hydrochasma was most likely a phishing email, according to an advisory published by Symantec. Researchers also observed Hydrochasma using Cobalt Strike Beacon, a legitimate penetration testing tool that attackers have widely adopted for executing commands, injecting, elevating, and impersonating processes, and uploading and downloading files on victim networks. This unique modus operandi makes Hydrochasma's activities stand out in the cybersecurity landscape.
Description last updated: 2024-11-08T05:02:07.396Z
What's your take? (Question 1 of 1)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Phishing
Malware
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the Hydrochasma Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more