Darkme

DarkMe is a threat actor group, also known as DarkCasino or Water Hydra, that has been actively executing large-scale cyberattacks since 2022. The group primarily uses a Visual Basic spy Trojan, also named DarkMe, in its operations. This Trojan was developed by the group in 2021 and has been continually refined to improve its functionality, countermeasures, and delivery methods, thereby increasing the stability and efficiency of attacks. The DarkMe Trojan's functions and use have remained consistent across different attack rounds, as observed in the NSFOCUS Research Labs' report on Operation DarkCasino. The group has exploited several vulnerabilities to distribute their malware, most notably CVE-2023-38831. Despite Microsoft's efforts to address this vulnerability with a patch in February 2024, DarkCasino weaponized it to specifically target financial institutions. The group has used this vulnerability for remote code execution, installing various malware families, including DarkMe, GuLoader, and Remcos RAT. Since April 2023, DarkCasino has also been exploiting a WinRAR zero-day vulnerability to execute multiple malware families onto cryptocurrency traders. Researchers at Group-IB discovered this campaign and found that the hackers used malware families like DarkMe, GuLoader, and Remcos RAT for financial gain. Real-world attacks involving CVE-2023-38831 delivering the DarkMe payload were reported as early as April this year, further emphasizing the persistent and evolving threat posed by this group.