DarkCasinoThreat actor
DarkCasino is an economically motivated APT group that targets online trading platforms, including cryptocurrencies, online casinos, network banks, and online credit platforms. They are skilled at stealing passwords to access victims' online accounts and have been active for over a year.From MISP Galaxy
Last reported 30 days ago, by The Hacker News4 reports
ATT&CK techniques
6 of 66 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027.001 Obfuscated Files or Information: Binary Padding”
- T1027.007Dynamic API Resolution
“T1027.007 Obfuscated Files or Information: Dynamic API Resolution”
- T1036Masquerading
“…ty that allows them to spoof file extensions, which means that they are able to hide the launch of malicious script within an archive masquerading as a ‘.jpg’, ‘.txt’, or any other file format”
- T1055Process Injection
“T1055.012 Process Injection: Process Hollowing”
- T1055.012Process Hollowing
“T1055.012 Process Injection: Process Hollowing”
- T1059.005Visual Basic
“DarkMe is a Visual Basic 6 (VB6) spy-RAT previously attributed to the financially-motivated APT tracked as Water Hydra and the EvilNum-led Operation DarkCasino.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories“DarkMe is a Visual Basic trojan linked to a threat actor known as Water Hydra (aka DarkCasino).”
-
DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer“…sual Basic 6 (VB6) spy-RAT previously attributed to the financially-motivated APT tracked as Water Hydra and the EvilNum-led Operation DarkCasino.”
-
Traders’ dollars in danger: CVE-2023-38831 zero-day vulnerability in WinRAR exploited by cybercriminals to target traders“The cybercriminals are exploiting this vulnerability to deliver the same tool used in the DarkCasino campaign described by NSFOCUS (Part 1, Part 2).”
-
Exploring the REF2731 Intrusion Set“This research was attributed to the financially motivated threat group, Evilnum [1, 2] and the DarkCasino campaign.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- posh[.]vipin 1 report
- onecause[.]comin 1 report
- raiselysite[.]comin 1 report
- adminmenueditor[.]comin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.