Loading threat actor…
DarkCasino is a threat activity label that has been discussed in connection with operational patterns resembling those of the financially motivated Evilnum group. Comparable activity used malicious document delivery, DLL side-loading, multi-stage loaders, remote-access malware, process injection, user-account-control bypass, steganographic payload concealment, and scheduled-task persistence. A definitive attribution of the referenced intrusion activity to DarkCasino has not been established.
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 malware families Mallory has associated with this actor across public reporting.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
25 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.