[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI75wgzK7etA6tv3fLggHe0JwG7FCrGOcSgS5GHpewqI":3},{"article":4,"iocs":48,"watch_terms":51,"solutions":52,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":32},"359b6e32-37bd-4e6f-9327-80e018b24dee","Zero-day hackers ditch exploits for a fake image file in new DarkMe campaign","zero-day-hackers-ditch-exploits-for-a-fake-image-file-in-new-darkme-campaign-1c4909","A threat group best known for exploiting previously unknown flaws in WinRAR and Windows has switched to a much simpler method: an email link to what appears to be an image. New research from Huntress details a 2026 campaign delivering DarkMe, a remote access trojan (RAT) historically linked to Water Hydra and also tracked as […] The post Zero-day hackers ditch exploits for a fake image file in new DarkMe campaign appeared first on IT Security Guru.","A threat group, previously known for exploiting zero-day vulnerabilities in WinRAR and Windows, has shifted to a simpler attack vector. The new campaign, detailed by Huntress, uses email links leading to what appears to be an image file to deliver the DarkMe remote access trojan (RAT). This RAT has historical ties to the Water Hydra group.","Hackers use fake image file links to deliver DarkMe RAT in new campaign.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F23\u002Fzero-day-hackers-ditch-exploits-for-a-fake-image-file-in-new-darkme-campaign\u002F?utm_source=rss&utm_medium=rss&utm_campaign=zero-day-hackers-ditch-exploits-for-a-fake-image-file-in-new-darkme-campaign",null,"2026-09-23T10:52:39+00:00","2026-09-23T12:00:24.239697+00:00",8,[17,20,23,26],{"name":18,"type":19},"Water Hydra","threat_actor",{"name":21,"type":22},"DarkMe","campaign",{"name":24,"type":25},"WinRAR","product",{"name":27,"type":25},"Windows","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":12,"name":30,"slug":31},"Malware","malware",[33,38,43],{"category":34},{"id":35,"icon":12,"name":36,"slug":37},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":39},{"id":40,"icon":12,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":12,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":31,"value":21,"context":50},"Remote Access Trojan (RAT) delivered in the campaign",[24,27],{"controls":53,"vendors":137},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":84,"name":85,"problem":86,"products":87},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":113,"name":114,"problem":115,"products":116},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[117,124,130],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":113,"product_name":121,"url":122,"description":123},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":131,"product_name":134,"url":135,"description":136},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[138],{"slug":139,"name":140,"logo_path":141,"roles":142},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png",[143],"reported_by",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":158},"darkme-rat-campaign-swaps-zero-days-for-fake-image-file-lures","DarkMe RAT Campaign Swaps Zero-Days for Fake Image File Lures","The Water Hydra-linked threat group has pivoted from exploiting complex zero-day vulnerabilities in WinRAR and Windows to a deceptively simple social engineering tactic: tricking users into clicking email links that masquerade as harmless image files to deliver the DarkMe RAT. This shift highlights that even sophisticated threat actors will abandon technical exploits when human deception proves more effective and lower-effort. The campaign underscores that end-user susceptibility to malicious links remains one of the most persistent and exploitable weaknesses in organizational security. Organizations that focus solely on patching technical vulnerabilities while neglecting user education create an opening for exactly this kind of adaptive adversary behavior.",[149,150,151,152,153,154,155,156,157],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 9 – Email and Web Browser Protections","CIS Control 10 – Malware Defenses","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-7 – Boundary Protection","MITRE ATT&CK T1566.002 – Phishing: Spearphishing Link","MITRE ATT&CK T1036 – Masquerading","NIST CSF PR.AT-1 – Awareness and Training",{}]