Water Hydra

The Advanced Persistent Threat (APT) group known as Water Hydra, also referred to as DarkCasino, has been identified as a significant threat actor in the cybersecurity landscape. The group is notorious for its exploitation of CVE-2024-21412, a vulnerability that allows them to bypass Microsoft Defender SmartScreen and infect users with the DarkMe malware. This campaign was first detected in January 2024 when Water Hydra updated its infection chain to execute a malicious Microsoft Installer File (.MSI), streamlining the DarkMe infection process. The group's modus operandi involves manipulating Windows Explorer views via the "search: protocol" and deceiving users into clicking on malicious internet shortcut files disguised as JPEGs. In February 2024, Microsoft addressed the CVE-2024-21412 vulnerability in its Patch Tuesday updates. However, before the patch was rolled out, threat actors like Water Hydra had already seized the opportunity to exploit it, particularly targeting financial institutions. Trend Micro researchers have reported that this flaw was used in a sophisticated zero-day attack chain by Water Hydra, underscoring the severity of zero-day threats in the realm of cybersecurity. Water Hydra’s intricate attack chain involves spear-phishing campaigns on forex and stock trading forums, demonstrating their focus on financial market traders. Despite Microsoft's efforts to patch the vulnerability, Water Hydra's actions highlight the ongoing challenges faced by cybersecurity defenses against evolving threat actors and their increasingly sophisticated tactics. The group's ability to exploit vulnerabilities and evade security measures serves as a stark reminder of the importance of continuous vigilance and proactive threat intelligence in maintaining robust cybersecurity infrastructure.