S9013 DRYHOOK

malwareEnterprise

platformsLinux · Network Devices

also known asDRYHOOK

DRYHOOK is Python script used to steal credentials. DRYHOOK was first reported in January 2025, and has previously been leveraged by People's Republic of China (PRC) state-affiliated threat actors identified as UNC5221 and SYLVANITE.

techniques used (11)

ATT&CK techniques this enables or maps to.

T1027.013Encrypted/Encoded File
T1056.001Keylogging
T1059.006Python
T1059.008Network Device CLI
T1074.001Local Data Staging
T1222.002Linux and Mac Permissions
T1489Service Stop
T1556Modify Authentication Process
T1556.004Network Device Authentication
T1601Modify System Image
T1685Disable or Modify Tools

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan