#ParsedReport #CompletenessHigh
22-09-2026

DarkMe Email Campaign Broadens Targeting For APT RAT

https://www.huntress.com/blog/darkme-rat-abandons-exploits

Report completeness: High

Actors/Campaigns:
Water_hydra (motivation: cyber_espionage, financially_motivated)
Darkcasino (motivation: financially_motivated)
Evilnum

Threats:
Darkme
Runpe_tool
Process_hollowing_technique
Macc_stealer
Clickfix_technique

Victims:
Foreign exchange trading, Stock trading, Online gambling, Cryptocurrency, Corporate users

Industry:
Financial

Geo:
Italian, Spain, Spanish

CVEs:
CVE-2024-21412 [Vulners]
CVSS V3.1: 8.1,
Vulners: Exploitation: True
Soft:
- microsoft windows_10_1809 (<10.0.17763.5458)
- microsoft windows_10_21h2 (<10.0.19044.4046)
- microsoft windows_10_22h2 (<10.0.19045.4046)
- microsoft windows_11_21h2 (<10.0.22000.2777)
- microsoft windows_11_22h2 (<10.0.22621.3155)
have more...
CVE-2023-38831 [Vulners]
CVSS V3.1: 7.8,
Vulners: Exploitation: True
Soft:
- rarlab winrar (<6.23)


TTPs:
Tactics: 3
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1012, T1027.013, T1055.012, T1057, T1082, T1105, T1112, T1140, T1203, T1204.001, have more...

IOCs:
Url: 2
File: 32
Path: 4
Command: 1
Registry: 13
Domain: 9
IP: 2
Hash: 9

Soft:
WinRAR, Windows Defender, Windows Defender SmartScreen, SonicWall, Windows Installer, Aegis, Windows Registry, ledger live, keepass, bitwarden, have more...

Wallets:
metamask, trezor

Algorithms:
zip, xor, rc4, sha256

Win API:
EXE, CopyFile, Run, CreateToolhelp32Snapshot, Process32First, Process32Next, RegCreateKeyExA, RegSetValueExA, CreateProcessA, ZwUnmapViewOfSection, have more...

Win Services:
bits

Languages:
vbscript, powershell, visual_basic