Water Hydra
Water Hydra, also known as DarkCasino, is a financially motivated threat actor that some reporting describes as an APT. The group was first detected in 2021. Reported targeting includes financial market traders, as well as banks, cryptocurrency platforms, trading services, gambling sites, and casinos. Water Hydra has used zero-day exploits in its intrusion chains, including CVE-2024-21412 to bypass Microsoft Defender SmartScreen via malicious Internet Shortcut files and deliver DarkMe, and previously the WinRAR zero-day CVE-2023-38831. Reporting cited here states the group seeded DarkMe in forex trading forums and stock trading Telegram channels, and that in January 2024 it updated its infection chain exploiting CVE-2024-21412 to execute a malicious .MSI and streamline DarkMe infection. The content also notes Water Hydra has been described as evolving from an economically motivated group into an advanced persistent threat.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financial Services
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
the exploitation of a zero-day vulnerability (CVE-2024–21412). This vulnerability allowed the bypass of Microsoft Defender SmartScreen through malicious .url files and WebDAV shares.
This same crew previously used the WinRAR code execution vulnerability CVE-2023-38831 months before it was disclosed, again to target stock traders with the same malware.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Exploiting CVE-2024-21412 to bypass Microsoft Defender SmartScreen via malicious .url files and WebDAV shares in phishing activity targeting traders.
Attributed with exploiting CVE-2024-21412 to bypass Windows SmartScreen using malicious internet shortcuts disguised as JPEGs, and previously leveraging WinRAR zero-days to deploy DarkMe.
Economically motivated intrusion activity targeting financial market traders and related financial/crypto/gambling verticals, using zero-day exploit chains to bypass Windows SmartScreen and deliver the DarkMe trojan (including via .MSI execution).
Financially motivated activity targeting financial traders via lure content in forex trading forums and stock-trading Telegram channels, leveraging Windows security feature bypasses to deliver a remote-access trojan (DarkMe).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.