Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · DarkCasino · Unknown · misp-galaxy · refreshed 2026-10-06

DarkCasino

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2023-38831

Analyst brief

misp-galaxy

DarkCasino is an economically motivated APT group that targets online trading platforms, including cryptocurrencies, online casinos, network banks, and online credit platforms. They are skilled at stealing passwords to access victims' online accounts and have been active for over a year. DarkCasino exploits vulnerabilities, such as the WinRAR vulnerability CVE-2023-38831, to launch phishing attacks and steal online property.

CVEs DarkCasino is cited as exploiting

none on KEV
  1. CVE-2023-388312026-10-17
    1. “CVE-2023-38831 is an arbitrary execution vulnerability in WinRAR software that was first exploited by DarkCasino in April 2023 and fixed in a new version of WinRAR v6.23 in August 2023.”

      cited as exploiting · source: nsfocusglobal.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

1 source
  1. 1.nsfocusglobal.com/the-new-apt-group-darkcasino-and-the-global-surge-in-w…

Track DarkCasino on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.