- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Motivation
- Financial gain
- Seen
- 2021
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0191 · darkcasino
What it is
DarkCasino is an economically motivated APT group that targets online trading platforms, including cryptocurrencies, online casinos, network banks, and online credit platforms. They are skilled at stealing passwords to access victims' online accounts and have been active for over a year. DarkCasino exploits vulnerabilities, such as the WinRAR vulnerability CVE-2023-38831, to launch phishing attacks and steal online property.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Water Hydra
Targets
- Countries
- Armenia, Canada, Cyprus, France, Ireland, Malta, Philippines, Poland, Singapore, Spain, Switzerland
- Sectors
- Casinos and Gambling, Financial
Tools
The tools and malware families the sources tie to it.
- DarkComet
- DarkMe
- GuLoader
- Killer RAT
- PikoloRAT
- Xploit
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de