DarkMe (Water Hydra, 2024) — historical delivery and C2 domains contacted by a scanned page

Scanned pages that sent requests to a domain published for the December 2023 to February 2024 DarkMe campaign reported by Trend Micro as Water Hydra (CVE-2024-21412): fxbulls.ru (delivery website), unfawjelesst322.com (command and control), and 87iavv.com and p2oaviwt39ui.com (campaign indicators, role not established). This hunt covers a page that contacts the infrastructure; a companion hunt covers scans of the infrastructure itself. Only requests observed during the scan count. A link that was never followed, or an article that quotes these domains, does not match. These indicators are historical. Current ownership and activity have not been verified, so a match is a lead for review, not evidence that a site is malicious today. Virus Bulletin groups the DarkMe family with GriffithRAT under the Griffith intrusion set, but these indicators establish a DarkMe association only, not Griffith attribution.