Threat actor · all actors

DarkHydrusG0079 unknown

aka DarkHydrus, LazyMeerkat, G0079, Obscure Serpens

Last updated: 2026-08-20

0attributed CVEs

12ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. (Citation: Unit 42 DarkHydrus July 2018) (Citation: Unit 42 Playbook Dec 2017)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0079

CrowdStrikenation-animal names

Obscure Serpens

Unclassifiedno scheme matched

DarkHydrusLazyMeerkat

How we know this

Data origin: MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques: MITRE ATT&CK STIX mappings — 12 ATT&CK techniques on file.
Named victims: None on file.

See how actor data is built for the full pipeline.

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

T1059 Command and Scripting Interpreter ↗
T1059.001 PowerShell ↗
T1187 Forced Authentication ↗
T1204 User Execution ↗
T1204.002 Malicious File ↗
T1221 Template Injection ↗
T1564 Hide Artifacts ↗
T1564.003 Hidden Window ↗
T1566 Phishing ↗
T1566.001 Spearphishing Attachment ↗
T1588 Obtain Capabilities ↗
T1588.002 Tool ↗

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`CM-2`	8 / 12	67%
`CM-6`	8 / 12	67%
`SI-4`	8 / 12	67%
`CA-7`	7 / 12	58%
`SI-10`	7 / 12	58%
`SI-3`	7 / 12	58%
`CM-7`	6 / 12	50%
`SC-7`	6 / 12	50%
`SI-2`	6 / 12	50%
`SI-7`	6 / 12	50%
`AC-4`	5 / 12	42%
`SC-44`	5 / 12	42%
`SI-8`	5 / 12	42%
`IA-9`	4 / 12	33%
`RA-5`	4 / 12	33%

Co-occurring actors

None.