Skip to main content
Mallory
Back to malware
MalwareUsed by 1 actorExploits 2 CVEs

PikoloRAT

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial
EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES
CVE-2023-38831Arbitrary Code Execution in WinRAR Archive File HandlingExploited in the wild

WaterHydra/DarkCasino APT group -- the financially-motivated crew behind ... CVE-2023-38831 (WinRAR zero-day)... 2023-04 WaterHydra exploits CVE-2023-38831 (WinRAR 0-day) 130+ trader devices confirmed infected

via breakglass intelintel.breakglass.tech
CVE-2024-21412Windows Internet Shortcut Files SmartScreen Security Feature BypassExploited in the wild

WaterHydra/DarkCasino APT group -- the financially-motivated crew behind CVE-2024-21412 (Windows SmartScreen zero-day)... 2023-12-31 WaterHydra exploits CVE-2024-21412 (SmartScreen 0-day) ... 2024-02-13 Microsoft patches CVE-2024-21412

via breakglass intelintel.breakglass.tech
THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
WaterHydra

This operator still uses the un-cleaned DarkMe builder (Italian strings intact), supplements it with commodity QuasarRAT rather than the custom PikoloRAT the main WaterHydra team uses, and relies on GitHub for payload staging rather than WebDAV shares.

via breakglass intelintel.breakglass.tech
MITRE ATT&CK

Techniques & procedures

1 distinct technique documented for this family, organized by ATT&CK tactic.

Execution

1 technique
T1203Exploitation for Client ExecutionEvidence1
TacticExecution

MITRE ATT&CK Mapping Technique ID Usage Exploitation for Client Execution T1203 CVE-2024-21412, CVE-2023-38831

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
ip.v4●●●●●●●●●●●●View more in app3 months ago
ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
Start free trial
IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping1

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.