Water Hydra (Threat actor): news timeline & CVEs

DarkMe RAT trades zero-days for plain phishing emails

The DarkMe RAT has shifted from using zero-day exploits to simple phishing emails, targeting corporate users to steal cryptocurrency and credentials.

The DarkMe RAT, previously linked to Water Hydra (DarkCasino) and financial traders, is now being distributed through simple phishing emails to corporate targets. Instead of using zero-day exploits, attackers send a link to a malicious .pif file disguised as an image. The malware executes a complex chain, performs an inverted sandbox check by looking for common user applications, and ultimately deploys a Visual Basic 6 RAT and infostealer focused on cryptocurrency wallets and credentials.

Help Net SecuritySep 23, 13:24 UTC · 3d agoMalware in the wild 2 sources

[object Object]

The DarkMe malware is now being delivered via simple phishing emails, abandoning the zero-days previously used to deliver the payload.

Huntress researchers report a new DarkMe malware campaign that has abandoned zero-day exploits in favor of simple social engineering. The attack begins with a phishing email delivering a .pif file disguised as an image, which uses msiexec to fetch a remote MSI installer. This installer unpacks a VB6-based malware chain that executes via a COM object registered through rundll32.exe, a technique observed in prior Water Hydra campaigns. The shift to less sophisticated initial access methods indicates a trend of broadening target lists.

Huntressupdated Sep 23, 13:24 UTC · 3d agofirst Sep 22, 21:00 UTC · 4d agoMalware in the wild 2 sources1

Water Hydra

Timeline2 articles

Appears with

DarkMe RAT trades zero-days for plain phishing emails

[object Object]