DarkMe RAT trades zero-days for plain phishing emails
The DarkMe RAT has shifted from using zero-day exploits to simple phishing emails, targeting corporate users to steal cryptocurrency and credentials.
The DarkMe RAT, previously linked to Water Hydra (DarkCasino) and financial traders, is now being distributed through simple phishing emails to corporate targets. Instead of using zero-day exploits, attackers send a link to a malicious .pif file disguised as an image. The malware executes a complex chain, performs an inverted sandbox check by looking for common user applications, and ultimately deploys a Visual Basic 6 RAT and infostealer focused on cryptocurrency wallets and credentials.
- DarkMe RAT is now distributed via simple phishing emails instead of zero-day exploits.
- Attackers use a malicious .pif file disguised as a PNG image.
- The malware performs an inverted sandbox check by looking for user applications.
- DarkMe targets crypto wallets, credentials, and takes screenshots.
- The campaign targets everyday corporate users, not just financial traders.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 User Execution: Malicious FileT1059.001 Command and Scripting Interpreter: PowerShellT1055 Process InjectionT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- Threat actors
- Water HydraDarkCasino
- Malware
- DarkMe
- Organizations
- HuntressTrend MicroSonicWall
From the original article
3 min read at helpnetsecurity.com
DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.