Water Hydra

Water Hydra, also known as DarkCasino, is a threat actor group that has been exploiting the Windows SmartScreen vulnerability CVE-2024-21412 since mid-January 2024. This group has demonstrated a sophisticated attack chain, using this zero-day exploit to bypass Microsoft Defender SmartScreen and infect users with the DarkMe malware. The flaw allowed Water Hydra to execute a malicious Microsoft Installer File (.MSI) through a simple double-click of an internet shortcut disguised as a JPEG. This streamlined infection process was used in various campaigns involving well-known info stealers such as Lumma Stealer, DarkGate, and of course, DarkMe. In February 2024, Microsoft addressed the CVE-2024-21412 vulnerability in its Patch Tuesday updates. However, before the patch was released, threat actors like Water Hydra had already seized the opportunity to exploit it, particularly targeting financial market traders. Despite the security update, Water Hydra's exploitation of this vulnerability underscores the severity of zero-day threats in cybersecurity, demonstrating how quickly and effectively these groups can leverage unpatched vulnerabilities for their malicious activities. According to Trend Micro, Water Hydra uses a unique modus operandi that exploits the "search: protocol" to manipulate Windows Explorer views, deceiving users into clicking malicious internet shortcut files. Further analysis revealed that Water Hydra leveraged CVE-2024-21412 to bypass Microsoft Defender SmartScreen, employing a cascade of internet shortcuts to evade security measures. This enabled them to execute malicious payloads, such as the DarkMe malware, without the user's knowledge. This series of events highlights the importance of timely patching and robust security measures to mitigate the risk posed by threat actors like Water Hydra.