Loading malware…
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
This operator still uses the un-cleaned DarkMe builder (Italian strings intact), supplements it with commodity QuasarRAT rather than the custom PikoloRAT the main WaterHydra team uses, and relies on GitHub for payload staging rather than WebDAV shares.
1 distinct technique documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Mapping Technique ID Usage Exploitation for Client Execution T1203 CVE-2024-21412, CVE-2023-38831
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.