Loading threat actor…
Water Hydra, also known as DarkCasino, is a financially motivated cybercrime threat group first detected in 2021. It targets financial-market traders, banks, cryptocurrency platforms, foreign-exchange and stock-trading services, gambling websites, and casinos worldwide. Early activity was attributed to Evilnum because of similarities in phishing techniques, but Water Hydra was identified as a distinct group by November 2023. The group is associated with DarkMe, a Visual Basic–based remote-access trojan used for information theft and remote command execution. Water Hydra exploited the WinRAR vulnerability CVE-2023-38831 as a zero-day in 2023 against cryptocurrency and stock traders. In late 2023 and early 2024, it exploited CVE-2024-21412 to bypass Microsoft Defender SmartScreen and deliver DarkMe. Its spearphishing lures appeared on foreign-exchange forums and stock-trading Telegram channels, offering trading advice, technical-analysis charts, and financial tools. Water Hydra's infection chains use compromised websites, attacker-controlled WebDAV shares, and internet shortcuts disguised as images or documents. Nested shortcuts circumvent Mark-of-the-Web handling and suppress SmartScreen warnings. Subsequent stages employ scripts, malicious Windows Installer packages, obfuscated loaders, COM registration and execution, and process hollowing. Decoy stock charts conceal the infection from victims. DarkMe supports host and antivirus reconnaissance, directory enumeration, file manipulation, archive creation, and shell command execution over a custom TCP command-and-control protocol. Documented infections establish persistence through COM registration and user-level Run keys.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
52 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 malware families Mallory has associated with this actor across public reporting.
4 CVEs Mallory has associated with this actor across public reporting. 4 of them are exploited in the wild (not necessarily by this actor).
66 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.