● Malware

DRYHOOK

DRYHOOK is Python script used to steal credentials. DRYHOOK was first reported in January 2025, and has previously been leveraged by People's Republic of China (PRC) state-affiliated threat actors identified as UNC5221 and SYLVANITE.

View graph Watch Export

Indicators tracked

Intelligence Reports30

30 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

11 relationships

T1056.001: Keylogging

source

T1222.002: Linux and Mac Permissions

source

T1027.013: Encrypted/Encoded File

source

T1074.001: Local Data Staging

source

T1489: Service Stop

source

T1059.008: Network Device CLI

source

T1601: Modify System Image

source

T1685: Disable or Modify Tools

source

T1059.006: Python

source

T1556: Modify Authentication Process

source

T1556.004: Network Device Authentication

source