Known malicious kithighother

DarkMe (Water Hydra, 2024) — historical delivery and C2 domains as the scanned URL

family: darkme-griffith-2026-09

Scans whose submitted or final URL is on a domain published for the December 2023 to February 2024 DarkMe campaign reported by Trend Micro as Water Hydra (CVE-2024-21412). fxbulls.ru was the delivery website. unfawjelesst322.com was a DarkMe command-and-control domain, also identified by SonicWall. 87iavv.com and p2oaviwt39ui.com were published as campaign network indicators without an established role. These indicators are historical. Current ownership and activity have not been verified, so a match is a lead for review, not evidence that a site is malicious today. Virus Bulletin groups the DarkMe family with GriffithRAT under the Griffith intrusion set, but these indicators establish a DarkMe association only, not Griffith attribution.

Anchors

SMQL queryrun

domain:fxbulls.ru OR domain:87iavv.com OR domain:p2oaviwt39ui.com OR domain:unfawjelesst322.com

Provenance

Added: 2026-09-17 14:40

Matches these exact domains, including their www. form. Other subdomains are not matched. The published delivery URLs (fxbulls.ru/wp-content/uploads/2023/12/photo_2023-12-29.jpg.htm and .html) are covered by the domain match. A command-and-control domain may never serve a web page, so an empty or failed capture does not clear it. Some public threat lists label these indicators Evilnum; Griffith, DarkMe, Water Hydra, DarkCasino and Evilnum are not interchangeable names. Not included: the GriffithRAT sample identifiers 7e39940f9bdaecf98609899930bdcc70 and 0d937ba802c989d46b111ae7f8b3cb13 (Kaspersky: Trojan.Win64.GriffithRAT.m and .n). They identify Windows executables rather than web infrastructure, and the source does not state the hash algorithm. Trend Micro's original IOC file is no longer available at its published URL.

References:

Sightings (0)

No sightings recorded yet.