OTX Threat: DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer

DarkMe, a Visual Basic 6 spy-RAT previously linked to financially-motivated APT group Water Hydra, was observed in two separate incidents affecting organizations in August 2026. Previously notable for weaponizing zero-day exploits including CVE-2023-38831 and CVE-2024-21412, this campaign abandoned sophisticated exploits in favor of basic social engineering tactics. Victims received phishing email CVEs: CVE-2023-27532, CVE-2023-38831, CVE-2024-21412 Sectors: Finance