Experts Uncover DarkCasino: New Emerging APT Threat Exploiting WinRAR Flaw

A hacking group that leveraged a not too long ago disclosed security flaw in the WinRAR software program as a zero-working day has now been categorized as an entirely new sophisticated persistent danger (APT).

Cybersecurity business NSFOCUS has explained DarkCasino as an “economically inspired” actor that initial arrived to mild in 2021.

“DarkCasino is an APT threat actor with strong complex and finding out ability, who is superior at integrating numerous well known APT attack technologies into its attack procedure,” the organization claimed in an evaluation.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“Attacks released by the APT team DarkCasino are very frequent, demonstrating a strong motivation to steal on the internet house.”

DarkCasino was most not too long ago connected to the zero-working day exploitation of CVE-2023-38831 (CVSS score: 7.8), a security flaw that can be weaponized to start malicious payloads.

In August 2023, Group-IB disclosed real-planet attacks weaponizing the vulnerability aimed at on the net trading message boards at the very least since April 2023 to deliver a closing payload named DarkMe, which is a Visual Fundamental trojan attributed to DarkCasino.

The malware is equipped to accumulate host information, just take screenshots, manipulate documents and Windows Registry, execute arbitrary instructions, and self-update by itself on the compromised host.

Though DarkCasino was beforehand labeled as a phishing marketing campaign orchestrated by the EvilNum team concentrating on European and Asian on-line gambling, cryptocurrency, and credit history platforms, NSFOCUS said its constant tracking of the adversary’s functions has authorized it rule out any likely connections with recognised risk actors.

The exact provenance of the risk actor is currently not known.

“In the early days, DarkCasino mostly operated in countries close to the Mediterranean and other Asian nations around the world applying on the net fiscal solutions,” it claimed.

“Far more recently, with the improve of phishing strategies, its attacks have achieved consumers of cryptocurrencies around the globe, even together with non-English-speaking Asian nations such as South Korea and Vietnam.”

Numerous risk actors have joined the CVE-2023-38831 exploitation bandwagon in recent months, which includes APT28, APT40, Dark Pink, Ghostwriter, Konni, and Sandworm.

Ghostwriter’s attack chains leveraging the shortcoming have been observed to pave the way for PicassoLoader, an intermediate malware that acts as a loader for other payloads.

“The WinRAR vulnerability CVE-2023-38831 brought by the APT group DarkCasino delivers uncertainties to the APT attack problem in the 2nd 50 percent of 2023,” NSFOCUS stated.

“Several APT teams have taken edge of the window period of time of this vulnerability to attack critical targets these kinds of as governments, hoping to bypass the defense technique of the targets and realize their needs.”

Identified this report interesting? Comply with us on Twitter  and LinkedIn to go through much more exceptional written content we submit.