Hyrax
Hyrax is an information stealer used in a financially motivated credential-theft campaign attributed by Microsoft to Storm-2561. In the observed activity, victims searching for enterprise VPN software were redirected via SEO poisoning to spoofed vendor sites and malicious ZIP packages, including trojanized VPN installers impersonating Pulse Secure, Fortinet, Ivanti, GlobalProtect, and Sophos Connect. The infection chain used a fake MSI installer that dropped Pulse.exe together with malicious DLLs such as dwmapi.dll and inspector.dll into %CommonFiles%\Pulse Secure. The dwmapi.dll component acted as an in-memory loader that executed shellcode to load inspector.dll, which was identified as a variant of Hyrax. Hyrax captured VPN credentials entered into a fake VPN sign-in dialog, extracted URI and VPN sign-in credentials, and read stored configuration data from C:\ProgramData\Pulse Secure\ConnectionStore\connectionstore.dat. Stolen data was exfiltrated to attacker-controlled infrastructure, including 194.76.226[.]93:8080. The malware established persistence by adding Pulse.exe to the Windows RunOnce registry key. After stealing credentials, the fake client displayed an error and in some cases redirected victims to the legitimate vendor website to reduce suspicion. The campaign’s malicious binaries were digitally signed with a certificate issued to Taiyuan Lihua Near Information Technology Co., Ltd., which was later revoked. High-confidence related infrastructure mentioned in the reporting includes delivery via GitHub-hosted ZIP files and associated domains such as vpn-fortinet[.]com, ivanti-vpn[.]org, myconnection[.]pro, and v pn-connection[.]pro.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The dwmapi.dll file works as an in-memory loader, executing shellcode that loads inspector.dll — a variant of the Hyrax infostealer. Hyrax captures VPN credentials entered through the fake login screen and reads stored configuration data from C:\ProgramData\Pulse Secure\ConnectionStore\connectionstore.dat, sending everything to 194.76.226[.]93:8080.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Resource Development
2 techniques
Resource Development
The trojans were digitally signed by a certificate issued to “Taiyuan Lihua Near Information Technology Co., Ltd.”... The digital signatures on these malicious files allowed them to bypass standard Windows security warnings and certain application allowlisting policies.
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
Users who click these results land on pages built to look identical to real VPN vendor portals, complete with matching logos and download buttons.
Defense Impairment
1 technique
Defense Impairment
Credential Access
3 techniques
Credential Access
"The fake VPN client presents a graphical user interface... prompting the user to enter their credentials... the application captures the credentials entered and exfiltrates them..."
Collection
1 technique
Collection
Command and Control
1 technique
Command and Control
Exfiltration
2 techniques
Exfiltration
IOCs tracked for this family
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hyrax is an infostealer used in fake VPN installer campaigns to capture VPN credentials and stored connection configuration data, then exfiltrate that information to attacker-controlled infrastructure. In this campaign it is delivered via a malicious MSI and loaded through DLL-based in-memory execution.
An information stealer variant used to harvest and exfiltrate VPN credentials, including through a fake VPN sign-in dialog.
Credential-stealing infostealer (delivered as inspector.dll) used in trojanized VPN installers to collect VPN URIs, sign-in credentials, and stored VPN configuration data (e.g., connectionstore.dat) and exfiltrate it to attacker-controlled C2.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.