S9013: DRYHOOK

DRYHOOK is Python script used to steal credentials. DRYHOOK was first reported in January 2025, and has previously been leveraged by People's Republic of China (PRC) state-affiliated threat actors identified as UNC5221 and SYLVANITE.[1][2][3]

EnterpriseS9013MalwareObject v1.0ModifiedApr 23, 2026, 03:09 UTC (UTC+00:00)

S9013: DRYHOOK describes [DRYHOOK](https://attack.mitre.org/software/S9013) is Python script used to steal credentials. [DRYHOOK](https://attack.mitre.org/software/S9013) was first reported in January 2025, and has previously been leveraged by People's Republic of China (PRC) state-affiliated threat actors identified as UNC5221 and SYLVANITE.(Citation: Dragos SYLVANITE MuddyWater Electrum March 2026)(Citation: Google UNC5221 Ivanti January 2025)(Citation: Picus Security UNC5221 Ivanti May 2025)

Executive priority

S9013: DRYHOOK is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S9013: DRYHOOK by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux, Network Devices), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S9013: DRYHOOK appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

DRYHOOK

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques11 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1222.002	Linux and Mac PermissionsSub-technique	DRYHOOK has the ability to remount the filesystem as “read-write” to make changes and then restores it to “read-only” prior to killing processes to apply the modifications.[2][3]
Enterprise	T1056.001	KeyloggingSub-technique	DRYHOOK has captured user credentials and passwords in plaintext and has encrypted them in a stored file on the network device.[2][3]
Enterprise	T1074.001	Local Data StagingSub-technique	DRYHOOK has stored stolen credentials for future use in the temp folder of a victimized Ivanti Connect Secure VPN device, specifically in the file location `/tmp/cmmmap.kumMW`.[2][3]
Enterprise	T1059.008	Network Device CLISub-technique	DRYHOOK has the ability to interact with Ivanti Connect Secure environments and to modify system components.[2][3]
Enterprise	T1601	Modify System Image	DRYHOOK has modified the Ivanti Connect Secure VPN authentication Perl module `DSAuth.pm` by reading its contents in the buffer, then finding and replacing select lines of code.[2][3]
Enterprise	T1685	Disable or Modify Tools	DRYHOOK has killed all instances of the `cgi-server` process in order for the modified Perl module to be activated.[2]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	DRYHOOK has encrypted stolen credentials strings within a file using both Base64 and RC4 with a hard-coded key.[2][3]
Enterprise	T1556	Modify Authentication Process	DRYHOOK has intercepted and logged user credentials by modifying the Perl module in Ivanti Connect Secure VPN edge-devices located within `/home/perl/DSAuth.pm`.[2][3]
Enterprise	T1059.006	PythonSub-technique	DRYHOOK is a Python-based script that executes within the victim environment.[2][3]
Enterprise	T1489	Service Stop	DRYHOOK has terminated all instances of the `cgi-server` process before activating the modified DSAuth.pm file.[2]
Enterprise	T1556.004	Network Device AuthenticationSub-technique	DRYHOOK has patched victim appliances authentication routines to capture credentials in plaintext as users log in.[2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.0
Created: Apr 14, 2026, 13:25 UTC (UTC+00:00)
Modified: Apr 23, 2026, 03:09 UTC (UTC+00:00)
Raw hash: 9d167e8a352c51af...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.0	Apr 23, 2026, 03:09 UTC (UTC+00:00)	Current bundle	`9d167e8a352c…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.0	Apr 23, 2026, 03:09 UTC (UTC+00:00)	Older bundle	`9d167e8a352c…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Apr 23, 2026, 03:09 UTC (UTC+00:00)	Older bundle	`9d167e8a352c…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Dragos SYLVANITE MuddyWater Electrum March 2026
Dragos. (2026, March 24). Dragos 2026 OT Cybersecurity Report: Year in Review, O&G and Petrochemicals Focus. Retrieved April 17, 2026.
Open source URL
[2]
Google UNC5221 Ivanti January 2025
John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.
Open source URL
[3]
Picus Security UNC5221 Ivanti May 2025
Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.
Open source URL
[4]
mitre-attackS9013
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use