All news
threat actor activity

Precursor Intelligence

Kaspersky names Griffith: new cyber-mercenary set hits fintech and iGaming with DarkMe VB6 and C++ RAT

GriffithRAT is a new C++ implant paired with the established DarkMe VB6 malware, clustered via threat intel against fintech and iGaming targets.

8 September 2026
KasperskyGriffithDarkMeGriffithRATfintechiGaming
Kaspersky names Griffith: new cyber-mercenary set hits fintech and iGaming with DarkMe VB6 and C++ RAT

At a glance

2 CVEs2 actors1 target1 industry

Vulnerabilities

CVECVSSEPSSKEVPoCPRS risk
CVE-2025-210429.833.2%ExploitedAvailable85 · Critical
CVE-2025-433008.832.5%ExploitedAvailable73 · High

Threat actors

NameTypeOriginMotivation
Griffithunknown—fintech and iGaming sectors
Stealth FalconaptUnited Arab Emiratesespionage

Targets & victims

OrganisationSectorRegionStatus
SamsungConsumer ElectronicsMiddle Eastconfirmed

Industries

Consumer Goods Manufacturing

Technology affected

Samsung · GalaxySamsung · image-processing librarySamsung · libimagecodec.quram.soSamsung · Galaxy Z modelsSamsung · Galaxy S22

Malware & tooling

LandfallDarkMeGriffithRAT

Timeline

  1. Patched

    Samsung patches CVE-2025-21042

  2. Patch

    Samsung fixes CVE-2025-21042 in April 2025 Security Maintenance Release

Vulnerability details

CVE CVSS EPSS KEV PoC PRS risk
CVE-2025-21042 9.8 33.2% ✅ listed available 85.0 (Critical)
CVE-2025-43300 8.8 22.0% ✅ listed available 73.17 (High)

Griffith: A new cyber-mercenary intrusion set for fintech and iGaming

Kaspersky researchers have identified a new intrusion set they are calling Griffith, a cyber-mercenary toolkit built for fintech and iGaming targets. The set pairs the established DarkMe VB6 malware with a new C++-based implant, GriffithRAT, and clusters them into a single operational unit through threat intelligence correlation.

Griffith is not a single binary. It is a layered intrusion set: DarkMe handles the initial payload and persistence, while GriffithRAT provides the C++-based implant that runs the command-and-control loop. The two components share infrastructure and behavioral patterns that Kaspersky’s clustering analysis links into one set, distinguishing it from the typical single-malware drops seen in the same sectors.

The zero-day: CVE-2025-21042 in Samsung's image codec

The vulnerability is an out-of-bounds write in libimagecodec.quram.so, the Samsung image-processing library that parses DNG raw image files. It affects 86 products and is fixed in the SMR Apr-2025 Release 1 update. A remote attacker who gets a crafted image file parsed by the library can execute arbitrary code on the device.

The severity profile is consistent with a zero-click mobile exploit. CVSS 9.8 (v3.1) puts it in the critical band. EPSS sits at 33.2% in the 98th percentile, which is high for a Samsung image codec. It is listed in CISA’s Known Exploited Vulnerabilities catalog, and a public PoC is available. The PRS risk score of 85.0 (Critical) reflects the combination of the OOB write, the remote attack vector, and the Samsung-specific attack surface.

The second flaw: CVE-2025-43300 in Apple's image parser

The second flaw is an out-of-bounds write in Apple’s image parser, tracked as CVE-2025-43300. It is fixed in iOS 15.8.5 and iPadOS 15.8.5, as well as iOS 16.7.12 and iPadOS 16.7.12. A remote attacker who gets a malicious image file parsed by the library can trigger memory corruption on the device.

The severity profile is consistent with a zero-click mobile exploit. CVSS 8.8 (v3.1) puts it in the high band. EPSS sits at 22.0% in the 98th percentile. It is listed in CISA’s Known Exploited Vulnerabilities catalog, and a public PoC is available. The PRS risk score of 73.17 (High) reflects the OOB write, the remote attack vector, and the Apple-specific attack surface. Three affected products are listed, which is typical for an Apple image parser.

Who was hit: fintech, hospitality, and iGaming targets

The victims are not generic. Unit 42’s samples came from VirusTotal uploads out of Iraq, Iran, Morocco, and Turkey, and the campaign targeted Samsung Galaxy S22, S23, S24, Z Fold 4, and Z Flip 4 devices. That is a tight set of flagships, and the DNG image delivery over WhatsApp fits the profile of a precision strike rather than a mass-dropped dropper.

The actor attribution is where the story gets interesting. Unit 42 calls the spyware LANDFALL, but the loader component inside the implant is named “Bridge Head” — a naming convention shared by NSO Group, Variston, Cytrox, and Quadream. The C2 infrastructure overlaps with Stealth Falcon, a UAE-linked vendor previously seen against Emirati journalists and dissidents since 2012. Turkey’s USOM flagged one of the six C2 servers as malicious, which is the kind of cross-check that usually confirms a government customer. The full set is a commercial Android spyware framework, not a single binary, and it sits in the same ecosystem as Coruna and DarkSword.

Key points

  • New intrusion set named Griffith targets fintech and iGaming sectors.
  • Campaign pairs the established DarkMe VB6 malware with a new C++-based GriffithRAT implant.
  • Samples were clustered via threat intelligence, linking the two components into a single intrusion set.
  • Attributed to a cyber-mercenary actor, not a state or major commercial vendor.

Further reading & sources