DarkWatchman
DarkWatchman is a JavaScript-based, fileless remote access trojan associated with the financially motivated threat group Hive0117. It has been used since at least 2021 in phishing campaigns targeting accountants and corporate finance departments, primarily at Russian organizations, with additional victims reported in Belarus, Kazakhstan, Uzbekistan, Lithuania, and Estonia. Delivery has been observed via spearphishing emails carrying password-protected ZIP or RAR archives disguised as routine accounting or business documents such as invoices, reconciliation statements, waybills, and debt notices; executing a hidden file inside the archive installs DarkWatchman and downloads a keylogger module.
The malware provides covert remote control of compromised Windows systems and has been described as enabling attackers to run commands remotely, download additional malicious tools, and move laterally across a company network. Observed follow-on tooling in Hive0117 intrusions includes LiteManager, BitRAT, and malware with hVNC capability. DarkWatchman can execute PowerShell commands, including using PowerShell to run a keylogger, and can also use WMI to execute commands. It performs host reconnaissance including collecting the victim username, identifying the OS locale, querying the Registry to determine whether it is already installed, retrieving browser history, and listing signed Plug and Play drivers for smart card readers. Operators have relied on system information discovery to maintain persistence and avoid detection.
DarkWatchman uses the Windows Registry extensively: it can stage local data there and store configuration strings, the keylogger, and component output in the Registry. It can encode data in hexadecimal form before sending it to command-and-control infrastructure and can use TLS to encrypt its C2 channel. For persistence, it has created scheduled tasks. Defense evasion and cleanup behaviors include uninstalling malicious components from the Registry, stopping processes, clearing browser history, and deleting shadow volumes using vssadmin.exe.
In Hive0117 operations, DarkWatchman infections were used to gain access to corporate remote banking systems and online banking portals from the victim’s own machine, making activity appear legitimate. The accompanying keylogger has been reported to intercept keystrokes, monitor clipboard contents, and track connection of cryptographic tokens commonly used for remote banking authentication. After access was obtained, attackers created fraudulent payroll or salary payment orders that routed funds to attacker-controlled accounts, causing multimillion-ruble losses.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Злоумышленники нацелились на бухгалтеров компаний и заражают их машины малварью DarkWatchman, чтобы затем использовать доступ к системам дистанционного банковского обслуживания (ДБО) для хищения денег. ... После запуска такого файла в систему жертвы устанавливается вредонос DarkWatchman, который загружает на зараженную машину модуль кейлоггера.
Techniques & procedures
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Initial Access
3 techniques
Initial Access
With control of an accountant’s machine, attackers could log into corporate online banking portals and initiate transactions directly from the compromised system, making the activity appear legitimate.
Execution
6 techniques
Execution
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
DarkWatchman gives attackers the ability to run commands remotely...
The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
Persistence
3 techniques
Persistence
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
With control of an accountant’s machine, attackers could log into corporate online banking portals and initiate transactions directly from the compromised system, making the activity appear legitimate.
The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution. | Many malware families store configuration, payloads, encryption keys, C2 addresses, or other operational data in Registry keys, such as QakBot storing configuration in a randomly named subkey under HKCU\Software\Microsoft and PolyglotDuke writing encrypted JSON configuration files to the Registry.
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
7 techniques
Stealth
The emails were sent from what appeared to be legitimate but likely compromised accounts... Attached files were packaged in password-protected archives disguised as routine business documents...
APT5 has used the THINBLOOD utility to clear SSL VPN log files located at /home/runtime/logs.
DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
CSPY Downloader has the ability to remove values it writes to the Registry.
Defense Impairment
1 technique
Defense Impairment
The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution. | Many malware families store configuration, payloads, encryption keys, C2 addresses, or other operational data in Registry keys, such as QakBot storing configuration in a randomly named subkey under HKCU\Software\Microsoft and PolyglotDuke writing encrypted JSON configuration files to the Registry.
Credential Access
1 technique
Credential Access
Discovery
7 techniques
Discovery
The content repeatedly describes malware and threat actors querying, enumerating, searching, reading, or checking Windows Registry keys and values, e.g., "ADVSTORESHELL can enumerate registry keys," "APT41 queried registry values to determine items such as configured RDP ports and network configurations," and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
...и даже отслеживает подключение криптографического токена. Дело в том, что такие токены часто используются для входа в системы ДБО юридических лиц.
Collection
5 techniques
Collection
После запуска такого файла в систему жертвы устанавливается вредонос DarkWatchman, который загружает на зараженную машину модуль кейлоггера. Тот, в свою очередь, перехватывает нажатия клавиш...
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
Тот, в свою очередь, перехватывает нажатия клавиш, следит за содержимым буфера обмена...
Examples in the content include malware extracting or unpacking ZIP, RAR, CAB, tar.gz, and other archived content, such as 'Emotet has used a self-extracting RAR file to deliver modules to victims' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'
Command and Control
5 techniques
Command and Control
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
DarkWatchman gives attackers the ability to... download additional malicious tools...
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
Impact
1 technique
Impact
Akira will delete system volume shadow copies via PowerShell commands. Avaddon deletes backups and shadow copies using native system tools. Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet. BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.
Recent activity
62 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Fileless malware used to infect accountants’ machines, deploy a keylogger, capture keystrokes and clipboard contents, monitor cryptographic token connection, and facilitate theft from remote banking systems.
A remote access trojan used to maintain covert control over compromised systems, execute remote commands, download additional malicious tools, and move laterally across victim networks.
Known malware delivered via phishing; campaign targeted multiple sectors in Russia (and referenced alongside 'Sheriff').
Remote access trojan and stealer capable of data theft and providing hands-on keyboard control to attackers.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.