● Malware

Hydraq

Hydraq is a data-theft trojan first used by Elderwood in the 2009 Google intrusion known as Operation Aurora, though variations of this trojan have been used in more recent campaigns by other Chinese actors, possibly including APT17.

View graph Watch Export

Indicators tracked

Intelligence Reports90

90 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

22 relationships

T1113: Screen Capture

source

T1129: Shared Modules

source

T1573.001: Symmetric Cryptography

source

T1543.003: Windows Service

source

T1007: System Service Discovery

source

T1082: System Information Discovery

source

T1005: Data from Local System

source

T1112: Modify Registry

source

T1016: System Network Configuration Discovery

source

T1685.005: Clear Windows Event Logs

source

T1083: File and Directory Discovery

source

T1057: Process Discovery

source

T1048: Exfiltration Over Alternative Protocol

source

T1027: Obfuscated Files or Information

source

T1012: Query Registry

source

T1070.004: File Deletion

source

T1134: Access Token Manipulation

source

T1105: Ingress Tool Transfer

source

T1569.002: Service Execution

source