DarkMe RAT Campaign Analysis and Tradecraft Evolution

In late 2026, threat hunting activities identified a new campaign by the financially motivated APT actor Water Hydra (also associated with EvilNum and Operation DarkCasino). Previously known for leveraging zero-day vulnerabilities like CVE-2023-38831 (WinRAR) and CVE-2024-21412 (Defender SmartScreen), the actor has shifted toward lower-skill, high-volume social engineering. The new infection chain uses .PIF files disguised as images to trigger a multi-stage Visual Basic 6 (VB6) loader sequence that ultimately delivers the DarkMe RAT.

The technical execution features novel persistence through a custom protocol handler (Locked://) that masks malicious activity behind explorer.exe. The attack utilizes sophisticated evasion techniques, including a 329-application 'inverted sandbox' check that terminates execution unless specific consumer or business software is present. This demonstrates the actor's focus on legitimate human-operated systems rather than automated analysis environments.

This shift highlights a broader trend of advanced adversaries abandoning expensive technical exploits for cheaper, scalable social engineering tactics. Organizations in the financial services, cryptocurrency, and online gambling sectors remain at primary risk due to Water Hydra's financial motivations. Defenders should prioritize detecting anomalous use of .PIF files, MSI execution from remote URLs, and non-standard protocol handler registrations.