Loading malware…
DarkWatchman is a modular, fileless-style Windows remote access trojan associated with the financially motivated Hive0117 group, also tracked as Watch Wolf, Ratopak Spider, and UAC-0008. First observed in 2021, it has primarily targeted Russian organizations, particularly accounting and financial personnel, to facilitate theft through corporate remote-banking systems. It has also appeared in phishing activity targeting Russian aerospace and defense-adjacent organizations.
DarkWatchman is implemented primarily in JavaScript and PowerShell. Its JavaScript backdoor executes through Windows Script Host, while an encrypted PowerShell component implements keylogging. The malware relies on the Windows Registry to store configuration, encoded payload components, collected keylogging output, and staged data, minimizing on-disk artifacts. It establishes persistence through scheduled tasks and can remove installation artifacts after setup.
Capabilities include collection of keystrokes, clipboard contents, smart-card-reader information, usernames, operating-system locale, host details, and installed security-product information. It can execute PowerShell commands, download additional modules, communicate with command-and-control infrastructure over TLS, and encode collected data before transmission. DarkWatchman has used a Bitcoin OP_RETURN-based dead-drop resolver to obtain rotating command-and-control locations. It has also been observed compiling C# code on compromised hosts, registering supporting libraries, adding Microsoft Defender exclusions, clearing browser history, and deleting volume shadow copies when executed with administrative privileges.
Hive0117 has distributed DarkWatchman through accounting-themed spearphishing emails, including password-protected archives containing executable payloads masquerading as business documents. The group uses access obtained through affected systems, cryptographic tokens, and remote-banking applications to conduct fraudulent financial transfers, including payroll-register abuse.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The FMVT RAT DGA-domain length matches domains generated by DarkWatchman; Hive0117 had previously used the fileless DarkWatchman malware.
DarkWatchman is described as Hive0117's principal tool: a fileless modular JavaScript- and PowerShell-based trojan that resides in the Windows Registry and memory, with no executable payload files on disk. It uses Bitcoin OP_RETURN data as a dead-drop resolver for rotating C2 URLs.
DarkWatchman is described as Hive0117's principal tool: a fileless modular JavaScript- and PowerShell-based trojan that resides in the Windows Registry and memory, with no executable payload files on disk. It uses Bitcoin OP_RETURN data as a dead-drop resolver for rotating C2 URLs.
DarkWatchman is described as Hive0117's principal tool: a fileless modular JavaScript- and PowerShell-based trojan that resides in the Windows Registry and memory, with no executable payload files on disk. It uses Bitcoin OP_RETURN data as a dead-drop resolver for rotating C2 URLs.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
the script then proceeds to create a task scheduler entry in the system that will run the copied script every time the system starts up.
The backdoor creates a scheduled task to run with elevated permissions ... and is used to maintain persistence on the system, and is named using the UID.
Subsequently, it runs the JavaScript file with the following two commands in sequence via the command prompt... powershell.exe ... Add-MpPreference ... & ... wscript.exe /E:jscript 144039266 131
DarkWatchman is described as modular malware based on JavaScript and PowerShell; encoded commands are passed through -encodedcommand.
EXE-дроппер расшифровывает и запускает обфусцированный JS-скрипт через wscript.exe.
the script then proceeds to create a task scheduler entry in the system that will run the copied script every time the system starts up.
the script then proceeds to create a task scheduler entry in the system that will run the copied script every time the system starts up.
Обфускация затрудняет статический анализ; encoded-команды передаются через -encodedcommand.
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW.
The email posed as an internal communication... sent by a typo squatted domain ‘cdek[.]rest ’spoofing the logistic provider CDEK... posing as Al Jaber Group
As part of the installation routine, the backdoor will delete the SFX file to remove evidence of the file’s existence... The keylogger file is removed upon installation.
the script extracts a 4-byte key from the first 8 characters of the input string and XORs the remaining characters of the string with the key to obtain the data. Finally, the decrypted Base64 encoded data is saved to the registry
the RAT proceeds to execute a system command to delete all the restore points... Next, the function registers the “dynwrapx.dll” library by copying it to the %temp% directory and running the “regsvr32.exe” command with the “/i” and “/s” flags to install the library silently.
Finally, the script checks if the registry value “HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM\< uid + 0 >” exists... The malware saves all its configuration and the keylogger file content in the above-mentioned registry key.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
Next, the function attempts to connect to a C&C URL retrieved from the registry key uid + ‘c’... After gathering the captured stolen information, the RAT sends it to the C&C server.
The script queries mempool.space or blockstream.info transaction history, extracts OP_RETURN data, decodes it, and obtains the current C2 URL.
According to IBM’s X-Force, the malware collects system information and generates a beacon that will transmit the following information to the C2... An initial HTTP POST request is sent to the server's '/register' endpoint, transmitting the gathered system information.
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
75 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Fileless malware previously used by Hive0117; its domain-generation-algorithm domain length was cited as infrastructure evidence linking the current FMVT RAT activity to the group.
A registry-resident, fileless modular trojan delivered through phishing attachments. Its JavaScript loader executes through wscript.exe and uses PowerShell, stores payloads and keylogger data in HKCU Registry keys, can retrieve additional C2 modules, inject into legitimate processes, monitor keyboard and clipboard input, and detect USB cryptographic signing tokens. The reported 2026 variant obtains current C2 addresses from OP_RETURN fields in Bitcoin transactions via public blockchain-explorer APIs.
Fileless malware used to infect accountants’ machines, deploy a keylogger, capture keystrokes and clipboard contents, monitor cryptographic token connection, and facilitate theft from remote banking systems.
A remote access trojan used to maintain covert control over compromised systems, execute remote commands, download additional malicious tools, and move laterally across victim networks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.