Loading threat actor…
Water Hydra, also known as DarkCasino, is a financially motivated cybercrime threat actor active since at least 2021 and best known for targeting financial market participants, including forex and stock traders, banks, cryptocurrency platforms, trading services, gambling sites, and casinos. The group has been linked to exploitation of multiple zero-day vulnerabilities, notably CVE-2024-21412 and CVE-2023-38831, to deliver the DarkMe remote-access trojan. Water Hydra has used trader-focused lures distributed through forums and messaging channels, malicious internet shortcut files, WebDAV-based delivery chains, and crafted payload staging to bypass Microsoft Defender SmartScreen and streamline malware execution. DarkMe is the signature malware associated with Water Hydra. Reported campaigns show use of multi-stage loaders, script-based execution, AMSI bypasses, AES-encrypted payload staging, fileless .NET assembly loading, and persistence through autorun mechanisms and startup artifacts. More recent activity attributed to an operator linked with high confidence to the WaterHydra/DarkCasino lineage also used QuasarRAT alongside DarkMe, with delivery via GitHub-hosted encrypted payloads, PowerShell loaders, regsvr32 COM scriptlets, and mshta. Attribution linking Water Hydra to the evilgrou-tech operation is supported by shared malware-development artifacts connecting Water Hydra with earlier Evilnum-linked tooling, suggesting lineage overlap or operator continuity. That activity has been assessed as likely involving a lower-tier Water Hydra operator or affiliate using inherited DarkMe tooling. Water Hydra has demonstrated strong initial-access tradecraft centered on social engineering and malicious file execution, followed by defense evasion, persistence, and post-compromise remote access. The actor has also been observed abusing SmartScreen bypass vulnerabilities and using spoofing-style lures to make malicious content appear trustworthy to victims. Available reporting consistently characterizes the group as cybercriminal rather than state-sponsored, with financial gain as its dominant motive.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
the exploitation of a zero-day vulnerability (CVE-2024–21412). This vulnerability allowed the bypass of Microsoft Defender SmartScreen through malicious .url files and WebDAV shares.
2023-04 WaterHydra exploits CVE-2023-38831 (WinRAR zero-day), 130+ traders infected
Zero-day zraniteľnosti CVE-2024-29988 a CVE-2024-26234 sú aktívne zneužívané. CVE-2024-29988 (CVSS skóre 8,8) Vysoko závažná zraniteľnosť CVE-2024-29988 umožňuje útočníkom obísť bezpečnostnú funkciu Windows SmartScreen a spustiť špeciálne pripravený škodlivý súbor. Chyba bola aktívne zneužívaná hackerskou skupinou Water Hydra.
45 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially themed intrusion activity targeting forex traders and cryptocurrency users, using DarkMe RAT and QuasarRAT with GitHub-hosted multi-stage loaders. The content frames WaterHydra as still active in 2026 through an affiliate-linked operation and historical exploitation of trader-focused lures.
Financially motivated intrusion group tied to trader-focused campaigns, DarkMe RAT activity, and exploitation of CVE-2023-38831 and CVE-2024-21412. The report links current evilgrou-tech operations to this group through shared developer artifacts, infrastructure, tooling, and targeting.
Exploiting CVE-2024-21412 to bypass Microsoft Defender SmartScreen via malicious .url files and WebDAV shares in phishing activity targeting traders.
Actively exploiting the Windows SmartScreen security feature bypass zero-day CVE-2024-29988 to launch specially crafted malicious files.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.