Known malicious kitmediumother
DarkMe (Water Hydra, 2024) — historical delivery and campaign IPs (reassignment-prone)
family: darkme-griffith-2026-09
Short link:scanmalware.com/h/192
Scans that connected to, or were submitted directly as, one of five IP addresses published for the December 2023 to February 2024 DarkMe campaign reported by Trend Micro as Water Hydra (CVE-2024-21412). 84.32.189.74 hosted the HTTP/WebDAV delivery share (for example http://84.32.189.74/fxbulls/pictures/photo_2023-12-29.jpg.url). 179.43.172.127, 179.43.172.191, 64.31.63.70 and 64.31.63.194 were published as campaign IPs without a stated role. Rated medium because these are 2024 addresses in hosting ranges and may have been reassigned, in which case a match describes an unrelated site. Do not treat a match as current DarkMe or Griffith activity without fresh corroboration.
Anchors
SMQL queryrun
ip:84.32.189.74 OR ip:179.43.172.127 OR ip:179.43.172.191 OR ip:64.31.63.70 OR ip:64.31.63.194 OR domain:84.32.189.74 OR domain:179.43.172.127 OR domain:179.43.172.191 OR domain:64.31.63.70 OR domain:64.31.63.194Provenance
Added: 2026-09-17 14:40
Exact addresses only. The surrounding /24 ranges are not included, because neighbouring addresses in hosting ranges belong to unrelated customers. A URL that places one of these addresses before an @ sign (the user-info part) does not match, because the browser connects to the host after the @.
References:
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-smartscreen-zero-day/ioc-water-hydra-cve-2024-21412.txt
- https://www.virusbulletin.com/conference/vb2026/abstracts/threat-intelligence-driven-clustering-identifying-new-cyber-mercenary-intrusion-set/
- https://me-en.kaspersky.com/about/press-releases/kaspersky-uncovers-griffithrat-malware-targeting-fintech
Sightings (0)Atom feed
No sightings recorded yet.