Hive0117

Hive0117 is a financially motivated threat actor active since at least late 2021. It is also tracked as Watch Wolf, Ratopak Spider, and UAC-0008. The group primarily targets accounting and finance personnel at organizations, especially in Russia, to obtain access to corporate remote-banking environments and steal funds. Its operations have also affected organizations in Belarus, Kazakhstan, Uzbekistan, Lithuania, and Estonia. Hive0117 commonly uses phishing emails masquerading as routine accounting correspondence, including invoices, reconciliation statements, delivery documentation, and payment notices. Messages may originate from compromised legitimate business mailboxes and deliver password-protected archives containing executable payloads disguised as documents. The group has used the fileless DarkWatchman malware, as well as FMVT RAT in later activity, to profile hosts, execute operator commands, retrieve additional payloads, monitor clipboard data, and support remote access. DarkWatchman campaigns have included keylogging, registry-based fileless persistence and payload storage, encoded PowerShell execution, and process injection. Hive0117 has also deployed remote-access tooling, including HVNC-capable malware, to operate a concealed virtual desktop on a compromised system. The actor monitors for connected smart-card readers and cryptographic tokens used to authorize corporate banking transactions. After compromising an accounting workstation, Hive0117 abuses access to the victim’s legitimate remote-banking system to create fraudulent payment orders. A documented cash-out technique disguises transfers to attacker-controlled accounts as employee payroll payments, helping the transactions resemble routine business activity. Hive0117’s operations are assessed as financially motivated; its geographic origin is not established.