[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjR4hEHde9L7rtWLKTpzReDHB3y-GiokI1UeFqebh7Bg":3,"$fgjeLSXwcZt4RelGFYOif3StgwsFCIg3HItham1Mj2uQ":88},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":85,"created_at":86,"updated_at":87,"published_at":41},"kaspersky-names-griffith-new-cyber-mercenary-set-hits-fintech-and-igaming-with-d","Kaspersky names Griffith: new cyber-mercenary set hits fintech and iGaming with DarkMe VB6 and C++ RAT","GriffithRAT is a new C++ implant paired with the established DarkMe VB6 malware, clustered via threat intel against fintech and iGaming targets.","Kaspersky researchers identified a new intrusion set called Griffith, a cyber-mercenary campaign targeting fintech and iGaming that combines the established DarkMe VB6 malware with a new C++-based GriffithRAT implant, with samples clustered via threat intelligence.",[10,11,12,13,14,15],"Kaspersky","Griffith","DarkMe","GriffithRAT","fintech","iGaming","# Kaspersky names Griffith: new cyber-mercenary set hits fintech and iGaming with DarkMe VB6 and C++ RAT\n\n*GriffithRAT is a new C++ implant paired with the established DarkMe VB6 malware, clustered via threat intel against fintech and iGaming targets.*\n\n**Tags:** `Kaspersky` `Griffith` `DarkMe` `GriffithRAT` `fintech` `iGaming`\n\n> Kaspersky researchers identified a new intrusion set called Griffith, a cyber-mercenary campaign targeting fintech and iGaming that combines the established DarkMe VB6 malware with a new C++-based GriffithRAT implant, with samples clustered via threat intelligence.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2025-21042 | 9.8 | 33.2% | ✅ listed | available | 85.0 (Critical) |\n| CVE-2025-43300 | 8.8 | 22.0% | ✅ listed | available | 73.17 (High) |\n\n## Griffith: A new cyber-mercenary intrusion set for fintech and iGaming\n\nKaspersky researchers have identified a new intrusion set they are calling Griffith, a cyber-mercenary toolkit built for fintech and iGaming targets. The set pairs the established DarkMe VB6 malware with a new C++-based implant, GriffithRAT, and clusters them into a single operational unit through threat intelligence correlation.\n\nGriffith is not a single binary. It is a layered intrusion set: DarkMe handles the initial payload and persistence, while GriffithRAT provides the C++-based implant that runs the command-and-control loop. The two components share infrastructure and behavioral patterns that Kaspersky’s clustering analysis links into one set, distinguishing it from the typical single-malware drops seen in the same sectors.\n\n## The zero-day: CVE-2025-21042 in Samsung's image codec\n\nThe vulnerability is an out-of-bounds write in `libimagecodec.quram.so`, the Samsung image-processing library that parses DNG raw image files. It affects 86 products and is fixed in the SMR Apr-2025 Release 1 update. A remote attacker who gets a crafted image file parsed by the library can execute arbitrary code on the device.\n\nThe severity profile is consistent with a zero-click mobile exploit. CVSS 9.8 (v3.1) puts it in the critical band. EPSS sits at 33.2% in the 98th percentile, which is high for a Samsung image codec. It is listed in CISA’s Known Exploited Vulnerabilities catalog, and a public PoC is available. The PRS risk score of 85.0 (Critical) reflects the combination of the OOB write, the remote attack vector, and the Samsung-specific attack surface.\n\n## The second flaw: CVE-2025-43300 in Apple's image parser\n\nThe second flaw is an out-of-bounds write in Apple’s image parser, tracked as CVE-2025-43300. It is fixed in iOS 15.8.5 and iPadOS 15.8.5, as well as iOS 16.7.12 and iPadOS 16.7.12. A remote attacker who gets a malicious image file parsed by the library can trigger memory corruption on the device.\n\nThe severity profile is consistent with a zero-click mobile exploit. CVSS 8.8 (v3.1) puts it in the high band. EPSS sits at 22.0% in the 98th percentile. It is listed in CISA’s Known Exploited Vulnerabilities catalog, and a public PoC is available. The PRS risk score of 73.17 (High) reflects the OOB write, the remote attack vector, and the Apple-specific attack surface. Three affected products are listed, which is typical for an Apple image parser.\n\n## Who was hit: fintech, hospitality, and iGaming targets\n\nThe victims are not generic. Unit 42’s samples came from VirusTotal uploads out of Iraq, Iran, Morocco, and Turkey, and the campaign targeted Samsung Galaxy S22, S23, S24, Z Fold 4, and Z Flip 4 devices. That is a tight set of flagships, and the DNG image delivery over WhatsApp fits the profile of a precision strike rather than a mass-dropped dropper.\n\nThe actor attribution is where the story gets interesting. Unit 42 calls the spyware LANDFALL, but the loader component inside the implant is named “Bridge Head” — a naming convention shared by NSO Group, Variston, Cytrox, and Quadream. The C2 infrastructure overlaps with Stealth Falcon, a UAE-linked vendor previously seen against Emirati journalists and dissidents since 2012. Turkey’s USOM flagged one of the six C2 servers as malicious, which is the kind of cross-check that usually confirms a government customer. The full set is a commercial Android spyware framework, not a single binary, and it sits in the same ecosystem as Coruna and DarkSword.\n\n## Key points\n\n- New intrusion set named Griffith targets fintech and iGaming sectors.\n- Campaign pairs the established DarkMe VB6 malware with a new C++-based GriffithRAT implant.\n- Samples were clustered via threat intelligence, linking the two components into a single intrusion set.\n- Attributed to a cyber-mercenary actor, not a state or major commercial vendor.\n\n## Further reading & sources\n\n- [Virus Bulletin :: What cybersecurity experts are talking about in 2026](https:\u002F\u002Fwww.virusbulletin.com\u002Fblog\u002F2026\u002F08\u002Fwhat-cybersecurity-experts-are-talking-about-2026) — Virus Bulletin\n- ['Landfall' spyware abused zero-day to hack Samsung Galaxy phones | TechCrunch](https:\u002F\u002Ftechcrunch.com\u002F2025\u002F11\u002F07\u002Flandfall-spyware-abused-zero-day-to-hack-samsung-galaxy-phones\u002F)\n- [New LandFall spyware exploited Samsung zero-day via WhatsApp messages](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-landfall-spyware-exploited-samsung-zero-day-via-whatsapp-messages\u002F)\n- [What is Landfall spyware and how it hacked Samsung Galaxy phones: Explained | Mint](https:\u002F\u002Fwww.livemint.com\u002Fgadgets-and-appliances\u002Fwhat-is-landfall-spyware-and-how-it-hacked-samsung-galaxy-phones-explained-11762954948117.html)\n- [Samsung - Wikipedia](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSamsung)\n- [Samsung - Wikipedia](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSAMSUNG)\n- [Storm - Wikipedia](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FStorm)\n- [Storms: Breaking news and updates | NBC News](https:\u002F\u002Fwww.nbcnews.com\u002Fstorms)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-names-griffith-new-cyber-mercenary-set-hits-fintech-and-igaming-with-d.png?v=49da33218a",{"cves":19,"actors":36,"malware":50,"targets":55,"timeline":61,"industries":69,"technologies":74},[20,29],{"id":21,"kev":22,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2025-21042",true,"\u002Fvulnerabilities\u002FCVE-2025-21042",9.8,0.3317,"Critical",85,"3.1",{"id":30,"kev":22,"poc":22,"url":31,"cvss":32,"epss":33,"risk_band":34,"risk_score":35,"cvss_version":28},"CVE-2025-43300","\u002Fvulnerabilities\u002FCVE-2025-43300",8.8,0.325,"High",73.17,[37,43],{"url":38,"name":11,"slug":39,"type":40,"origin":41,"motivation":42},"\u002Fthreat-groups\u002Fgriffith","griffith","unknown",null,"fintech and iGaming sectors",{"url":44,"name":45,"slug":46,"type":47,"origin":48,"motivation":49},"\u002Fthreat-groups\u002Fstealth-falcon","Stealth Falcon","stealth-falcon","apt","United Arab Emirates","espionage",[51,53,54],{"name":52},"Landfall",{"name":12},{"name":13},[56],{"name":57,"sector":58,"status":59,"geography":60},"Samsung","Consumer Electronics","confirmed","Middle East",[62,66],{"date":63,"event":64,"description":65},"2025-04","Patched","Samsung patches CVE-2025-21042",{"date":63,"event":67,"description":68},"Patch","Samsung fixes CVE-2025-21042 in April 2025 Security Maintenance Release",[70],{"url":71,"name":72,"slug":73},"\u002Findustries\u002Fconsumer-goods-manufacturing","Consumer Goods Manufacturing","consumer-goods-manufacturing",[75,77,79,81,83],{"vendor":57,"product":76},"Galaxy",{"vendor":57,"product":78},"image-processing library",{"vendor":57,"product":80},"libimagecodec.quram.so",{"vendor":57,"product":82},"Galaxy Z models",{"vendor":57,"product":84},"Galaxy S22","threat_actor_activity","2026-09-08T07:10:17.697992+00:00","2026-10-16T12:28:49.379627+00:00",{"articles":89},[90,102,115,128],{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":100,"story_type":85,"created_at":101},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has identified a new APT group, Armored Likho, running a multi-stage spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer to steal credentials, browser data, and documents from government and critical infrastructure targets in Russia, Brazil, and Kazakhstan.",[95,96,10,97,98,99],"Armored Likho","BusySnake Stealer","APT","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":103,"title":104,"summary":105,"tags":106,"hero_image_url":113,"story_type":85,"created_at":114},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[107,108,109,110,111,112],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","2026-09-30T07:07:04.966623+00:00",{"slug":116,"title":117,"summary":118,"tags":119,"hero_image_url":126,"story_type":85,"created_at":127},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[120,121,122,123,124,125],"Fancy Bear","APT28","CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00",{"slug":129,"title":130,"summary":131,"tags":132,"hero_image_url":138,"story_type":85,"created_at":139},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[133,134,135,136,137],"AI malware","FunkSec","Palo Alto Unit 42","ransomware","LLM","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578","2026-09-26T12:10:59.266452+00:00"]