The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

NSFOCUS Research Labs analyzes DarkCasino, a financially motivated APT group, its use of the WinRAR CVE-2023-38831 zero-day, and how multiple known and unknown actors exploited this vulnerability in widespread campaigns targeting governments and crypto-related platforms. The report highlights the attack flow, key tools like DarkMe and Remcos, and a growing set of IOCs and attacker personas.
#DarkCasino #WinRAR #CVE-2023-38831 #DarkMe #Remcos #Bumblebee #DarkPink #Konni

Keypoints

DarkCasino is identified as an economically motivated APT group with large-scale targeting of cryptocurrency platforms, online casinos, and financial networks globally.
CVE-2023-38831 is an arbitrary execution vulnerability in WinRAR used to deliver payloads via decoy files and phishing/watering hole tactics, with anti-virus evasion features observed.
The attack process comprises vulnerability exploitation, load release, and Trojan execution, with an alternative flow using steganographic images to carry data.
- Several unconfirmed actors (Actor230830, Actor231003, Actor231004, Actor231010, Actor231009) conducted campaigns against the European Parliament, Serbia, New Zealand government departments, and Russia/Belarus, often delivering Remcos, Bumblebee, AthenaAgent, or other tools.
- NSFOCUS notes the proliferation of decoy PDFs, batch files, and phishing posts across forums and government/enterprise targets, signaling a broadening WinRAR-exploit ecosystem.

MITRE Techniques

[T1566.001] Phishing: Attachment – The campaign uses decoy PDF/BATCH attachments to lure victims into executing malicious files. Quote: “The vulnerability exploitation file was constructed … The batch will open the original decoy pdf file as well as a malicious file named Images.com.”
[T1189] Drive-by Compromise / Watering Hole – Attackers leverage watering hole phishing via online trading forums and forum posts to disseminate exploits. Quote: “DarkCasino constructed various post contents … lured forum users into opening malicious files attached or pointed to the posts.”
[T1203] Exploitation for Client Execution – CVE-2023-38831 is an arbitrary execution vulnerability in WinRAR and is exploited to trigger payloads. Quote: “CVE-2023-38831 is an arbitrary execution vulnerability in WinRAR software…”
[T1059.003] Command and Scripting Interpreter: Windows Command Shell – The attack flow uses batch files and cmd commands (e.g., “cmd /c … reg.exe import add.txt” and “cmd /c rundll32.exe …”). Quote: “The nb.ocx file mainly runs the following cmd commands: cmd /c cd APPDATARarDir&&cmd /c timeout 1&&cmd /c reg.exe import add.txt”
[T1112] Registry Run Keys / Modify Registry – The batch flow registers a COM component by writing to the host registry. Quote: “cmd /c cd APPDATARarDir&&cmd /c rundll32.exe /sta {EA6FC2FF-7AE6-4534-9495-F688FEC7858C} Mouse_Keyboard”
[T1059.005] Visual Basic – The DarkMe Trojan is a Visual Basic spy Trojan used in these campaigns. Quote: “The Trojan horse used by DarkCasino in this round of operations is DarkMe, which is commonly used by the group.”
[T1027] Masquerading / Obfuscated Files and Information – Obfuscation and oversized, obfuscated binaries (DarkMe expanded to over 20MB) to evade detection. Quote: “DarkCasino has added more obfuscation codes to the new Trojan, expanding the whole program file to over 20MB.”
[T1105] Ingress Tool Transfer – The loader downloads and executes additional payloads from remote locations (e.g., chrmap.exe). Quote: “the subsequent load Trojan will be downloaded from the designated remote location https://allnato[.]net/news/uploads/chrmap.exe”
[T1071.001] Web Protocols – C2 channel using Discord (AthenaAgent) for command and control. Quote: “uses the discord channel as the CnC server.”
[T1113] Screen Capture – DarkMe capabilities include host information collection and screen capture. Quote: “DarkMe is a Visual Basic spy Trojan. Its initial version appeared … Currently, it supports host information collection, screenshot…”
[T1059.003] Command and Scripting Interpreter (duplicate entry for cmd execution) – See above for batch file usage.
[T1036] Masquerading – Cabinet archive disguised as a .com/file type to execute payload. Quote: “Images.com file, which was exploited to execute batch files … is a loader-type Trojan designed by DarkCasino.”

Indicators of Compromise

[Hash] dd9146bf793ac34de3825bdabcd9f0f3 – DarkPink
[Hash] 5504799eb0e7c186afcb07f7f50775b2 – DarkPink
[Hash] c5331b30587dcaf94bfde94040d4fc89 – DarkPink
[Hash] ac28e93dbf337e8d1cc14a3e7352f061 – DarkPink
[Hash] fefe7fb2072d755b0bfdf74aa7c9013e – DarkPink
[Hash] 428a12518cea41ef7c57398c69458c52 – Konni
[Hash] 7bb106966f6f8733bb4cc5bf2ab2bab4 – GhostWriter
[Hash] 2b02523231105ff17ea07b0a7768f3fd – Actor230830
[Hash] 63085b0b7cc5bb00859aba105cbb40b1 – Actor231003
[Hash] 7195be63a58eaad9fc87760c40e8d59d – Actor231004
[Hash] 129ccb333ff92269a8f3f0e95a0338ba – Actor231010
[Hash] cd1f48df9712b984c6eee3056866209a – Actor231010
[Hash] b05960a5e1c1a239b785f0a42178e1df – Actor231010
[Hash] 6b5d5e73926696a6671c73437cedd23c – Actor231009
[IP] 89.96.196.150 – Actor230830 (used to reach remote beacon/commands)
[URL] https://allnato.net/news/uploads/chrmap.exe – Actor231003/Actor231010 payload download
[Domain] europarl.europa.eu – Actor230830 decoy flow
[File/Folder] Trading_Strategies_2023.rar – Vulnerability exploitation file structure
[File/Batch] Trading_Strategies_2023.pdf.cmd – Batch that triggers malicious execution

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print

The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits – NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.