Darkme

DarkMe is a threat actor group, also known as DarkCasino or Water Hydra, that has been active since 2022. They have gained notoriety for their use of the Trojan DarkMe in large-scale cyberattacks, primarily targeting financial institutions. The Trojan DarkMe, a Visual Basic spy Trojan, is a common tool used by this group. NSFOCUS Research Labs' detailed analysis reveals that the functionality of the Trojan DarkMe used in recent attacks remains consistent with previous versions employed by DarkCasino. Furthermore, an updated set of intrusions possibly linked to the Deathstalker cyber-mercenary group features an upgraded DarkMe VB6 OCX/DLL implant and more stealthy tactics, techniques, and procedures (TTPs), including a sophisticated infection chain. The group has been exploiting a vulnerability, CVE-2023-38831, to remotely execute code that installs malware from families such as DarkMe, GuLoader, and Remcos RAT. Real-world attacks involving this vulnerability were recorded as early as April of the current year, delivering a payload dubbed DarkMe attributed to DarkCasino. Additionally, since April 2023, hackers have abused a WinRAR zero-day vulnerability to execute multiple malware families onto cryptocurrency traders. Researchers at Group-IB discovered this campaign and found that hackers have utilized malware families like DarkMe, GuLoader, and Remcos RAT for financial gain. Despite Microsoft addressing the CVE-2023-38831 vulnerability in its February 2024 Patch Tuesday updates, threat actors like DarkMe continue to weaponize it to distribute their malware. The obfuscated commands used by the DarkMe downloader further complicate the mitigation efforts. As DarkMe continues to evolve its TTPs and exploit vulnerabilities for their operations, organizations, particularly those in the financial sector, must stay vigilant and employ robust cybersecurity measures to counter these threats.