S0203: Hydraq

S0203: Hydraq describes [Hydraq](https://attack.mitre.org/software/S0203) is a data-theft trojan first used by [Elderwood](https://attack.mitre.org/groups/G0066) in the 2009 Google intrusion known as Operation Aurora, though variations of this trojan have been used in more recent campaigns by other Chinese actors, possibly including [APT17](https://attack.mitre.org/groups/G0025).(Citation: MicroFocus 9002 Aug 2016)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: ASERT Seven Pointed Dagger Aug 2...

Executive priority

S0203: Hydraq is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0203: Hydraq by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0203: Hydraq appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Hydraq

Hydraq is a data-theft trojan first used by Elderwood in the 2009 Google intrusion known as Operation Aurora, though variations of this trojan have been used in more recent campaigns by other Chinese actors, possibly including APT17.[1][2][3][4][5][6][7][8]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques19 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1012	Query Registry	Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1129	Shared Modules	Hydraq creates a backdoor through which remote attackers can load and call DLL functions.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1569.002	Service ExecutionSub-technique	Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.CitationSymantec Hydraq Persistence Jan 2010
Enterprise	T1016	System Network Configuration Discovery	Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1082	System Information Discovery	Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.CitationSymantec Hydraq Jan 2010
Enterprise	T1005	Data from Local System	Hydraq creates a backdoor through which remote attackers can read data from files.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1112	Modify Registry	Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1105	Ingress Tool Transfer	Hydraq creates a backdoor through which remote attackers can download files and additional malware components.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1027	Obfuscated Files or Information	Hydraq uses basic obfuscation in the form of spaghetti code.[2][3]
Enterprise	T1543.003	Windows ServiceSub-technique	Hydraq creates new services to establish persistence.[3]CitationSymantec Hydraq Jan 2010CitationSymantec Hydraq Persistence Jan 2010
Enterprise	T1685.005	Clear Windows Event LogsSub-technique	Hydraq creates a backdoor through which remote attackers can clear all system event logs.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1573.001	Symmetric CryptographySub-technique	Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.CitationSymantec Hydraq Jan 2010
Enterprise	T1007	System Service Discovery	Hydraq creates a backdoor through which remote attackers can monitor services.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1070.004	File DeletionSub-technique	Hydraq creates a backdoor through which remote attackers can delete files.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1057	Process Discovery	Hydraq creates a backdoor through which remote attackers can monitor processes.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1113	Screen Capture	Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.CitationSymantec Hydraq Jan 2010
Enterprise	T1048	Exfiltration Over Alternative Protocol	Hydraq connects to a predefined domain on port 443 to exfil gathered information.CitationSymantec Hydraq Jan 2010
Enterprise	T1083	File and Directory Discovery	Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.[3]CitationSymantec Hydraq Jan 2010
Enterprise	T1134	Access Token Manipulation	Hydraq creates a backdoor through which remote attackers can adjust token privileges.CitationSymantec Hydraq Jan 2010

Associated objects

Groups, software, and campaigns

G0066: Elderwood

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. [1] The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. [2] [3]

G0001: Axiom

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 2.0
Created: Apr 18, 2018, 17:59 UTC (UTC+00:00)
Modified: Nov 17, 2024, 19:55 UTC (UTC+00:00)
Raw hash: 5d64f49a01d24605...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 15, 2026, 17:21 UTC (UTC+00:00)	2.0	Nov 17, 2024, 19:55 UTC (UTC+00:00)	Older bundle	`5d64f49a01d2…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	2.0	Nov 17, 2024, 19:55 UTC (UTC+00:00)	Current bundle	`5d64f49a01d2…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.0	Nov 17, 2024, 19:55 UTC (UTC+00:00)	Older bundle	`5d64f49a01d2…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
MicroFocus 9002 Aug 2016
Petrovsky, O. (2016, August 30). “9002 RAT” -- a second building on the left. Retrieved February 20, 2018.
Open source URL
[2]
Symantec Elderwood Sept 2012
O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.
Open source URL
[3]
Symantec Trojan.Hydraq Jan 2010
Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
Open source URL
[4]
ASERT Seven Pointed Dagger Aug 2015
ASERT. (2015, August). ASERT Threat Intelligence Report – Uncovering the Seven Pointed Dagger. Retrieved March 19, 2018.
Open source URL
[5]
FireEye DeputyDog 9002 November 2013
Moran, N. et al.. (2013, November 10). Operation Ephemeral Hydra: IE Zero-Day Linked to DeputyDog Uses Diskless Method. Retrieved November 17, 2024.
Open source URL
[6]
ProofPoint GoT 9002 Aug 2017
Huss, D. & Mesa, M. (2017, August 25). Operation RAT Cook: Chinese APT actors use fake Game of Thrones leaks as lures. Retrieved March 19, 2018.
Open source URL
[7]
FireEye Sunshop Campaign May 2013
Moran, N. (2013, May 20). Ready for Summer: The Sunshop Campaign. Retrieved November 17, 2024.
Open source URL
[8]
PaloAlto 3102 Sept 2015
Falcone, R. & Miller-Osborn, J. (2015, September 23). Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media. Retrieved March 19, 2018.
Open source URL
[9]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[10]
9002 RAT
(Citation: MicroFocus 9002 Aug 2016)
[11]
Aurora
(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Trojan.Hydraq Jan 2010)
[12]
HidraQ
(Citation: Novetta-Axiom)
[13]
HomeUnix
(Citation: Novetta-Axiom)
[14]
Homux
(Citation: Novetta-Axiom)
[15]
HydraQ
(Citation: Novetta-Axiom)
[16]
Hydraq
(Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Trojan.Hydraq Jan 2010)
[17]
McRat
(Citation: Novetta-Axiom)
[18]
MdmBot
(Citation: Novetta-Axiom)
[19]
Roarur
(Citation: Novetta-Axiom)
[20]
mitre-attackS0203
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use