darkwatchman

DarkWatchMan and Hive0117: Fileless Malware Evolution Targeting Russian Critical Infrastructure

DarkWatchMan is a fileless, modular malware family first observed in late 2021 and attributed to the financially motivated Hive0117 group. The malware is primarily delivered via spear-phishing emails containing password-protected archives, targeting Russian critical infrastructure (energy, etc).

Wes

Wes

— 12 min read
Share
DarkWatchMan and Hive0117: Fileless Malware Evolution Targeting Russian Critical Infrastructure
When the malware lives rent‑free in memory, even the bear can’t hibernate.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Have questions like this trying to get things into your SIEM??

  • DarkWatchMan campaign?
  • What are the specific technical capabilities and indicators of compromise (IoCs) associated with the DarkWatchMan malware?

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

TL;DR

Key Points

    • DarkWatchMan, a fileless modular malware attributed to Hive0117, is actively targeting Russian critical infrastructure and financial sectors via sophisticated phishing campaigns.
    • Enterprises must deploy advanced EDR/XDR solutions and behavioral analytics to detect PowerShell/.NET-based fileless activity and registry-based persistence.
    • The threat actor’s TTPs have rapidly evolved, leveraging encrypted payloads, modular architectures, and operational infrastructure reuse to evade detection and maintain persistence.
    • Hardened email security, phishing resilience programs, and network segmentation are essential to reduce initial infection risk and limit lateral movement.
    • No major public breaches are directly attributed, but ongoing campaigns indicate significant risk of espionage, data theft, and potential ransomware deployment, especially for organizations lacking layered defenses.
    • Continuous monitoring of Hive0117 infrastructure and proactive threat hunting are required to disrupt future campaigns.

Executive Summary

DarkWatchMan is a fileless, modular malware family first observed in late 2021 and attributed to the financially motivated Hive0117 group. The malware is primarily delivered via spear-phishing emails containing password-protected archives, targeting Russian critical infrastructure (energy, telecom, transport), financial services, and select European sectors. Campaigns have evolved from basic phishing to advanced fileless techniques using .NET and PowerShell, encrypted payloads, and registry-based persistence, complicating detection and response.

Hive0117 demonstrates operational overlap with DarkWatchMan through shared infrastructure, domain registration, and malware usage, with a focus on espionage, data theft, and potential ransomware deployment. While attribution is supported by multiple sources, public data remains limited and speculative, warranting ongoing monitoring.

Detection requires behavioral analytics focused on script execution anomalies, registry modifications, and spear-phishing patterns. Mitigation strategies include deploying and tuning EDR/XDR platforms, hardening email security, enforcing network segmentation, restricting script execution, and conducting targeted phishing resilience programs. Metrics such as mean time to detect/respond, phishing simulation failure rates, and unauthorized script execution frequency should be tracked.

Short-term forecasts indicate continued targeting of Russian and Eastern European critical sectors, with increasing sophistication in TTPs and infrastructure reuse. Long-term, Hive0117 is likely to adopt advanced evasion (potentially AI-driven obfuscation), expand targeting, and diversify initial access vectors. Proactive threat hunting, automated response, and cross-sector intelligence sharing are critical to countering this evolving threat.

Organizations in targeted sectors should prioritize layered defenses, continuous monitoring, and rapid incident response to reduce risk from DarkWatchMan and Hive0117 campaigns.

Research & Attribution

Historical Context

DarkWatchMan is a fileless malware family first reported in late 2021, notable for its use of .NET and PowerShell, modular architecture, and stealthy persistence. It has been linked to financially motivated cybercriminal groups conducting targeted attacks primarily in Europe and Russia. The malware is often delivered via phishing campaigns using password-protected archives.

Timeline

DarkWatchMan was first observed in late 2021. Since then, it has been involved in multiple campaigns, with evolving TTPs and expanding targeting, especially in Russian critical infrastructure and various industries. The associated threat actor group Hive0117 has been active since at least February 2022.

Origin

DarkWatchMan is attributed to financially motivated cybercriminals linked to the Hive0117 group. Hive0117 is known for large-scale phishing campaigns targeting Russian critical infrastructure and other sectors. The groups share infrastructure, domain registration data, and malware usage, indicating operational overlap.

Countries Targeted

  1. Russia – Primary target, especially critical infrastructure and various industries.
  2. Ukraine – Targeted in campaigns related to regional conflicts.
  3. European countries (e.g., Poland, Belgium) – Targeted in financial and industrial sectors.
  4. Other regions – Limited data on additional targeting.

Sectors Targeted

  1. Critical Infrastructure – Especially in Russia, including energy and telecommunications.
  2. Financial Services – Banks and insurance companies targeted via phishing.
  3. Manufacturing – Industrial organizations targeted for financial gain.
  4. Media and Tourism – Targeted in broad campaigns.
  5. Biotechnology and Retail – Observed in some campaigns.

Motivation

The primary motivation is financial gain through targeted phishing campaigns delivering DarkWatchMan malware for espionage, data theft, and potential ransomware deployment.

Attack Types

DarkWatchMan campaigns use fileless malware techniques leveraging .NET and PowerShell, delivered via phishing emails with password-protected archives. The malware employs stealthy persistence and modular architecture to evade detection.

  • Hive0117: Financially motivated group linked to DarkWatchMan through shared infrastructure and malware usage.

Breaches Involving This Threat Actor

  • No publicly disclosed major breaches directly attributed to DarkWatchMan, but campaigns have targeted critical infrastructure and financial sectors with potential data theft and disruption.

Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps

(Subscribers Only)

Detailed Sections

1. Threat Actor Attribution and Known Affiliations

DarkWatchMan malware is attributed to financially motivated cybercriminals linked to the Hive0117 group. Hive0117 has been active since at least February 2022 and is known for large-scale phishing campaigns targeting Russian critical infrastructure and various industries. The groups share infrastructure, domain registration data, and malware usage, indicating operational overlap and shared toolsets.

Note on Attribution Uncertainty:

Attribution to Hive0117 is supported by multiple sources, but public data is limited and no official government advisories explicitly confirm this linkage. The attribution is based on shared infrastructure and malware usage patterns. No conflicting attributions were found, but the data remains sparse and should be monitored for updates.

2. Campaign Evolution and TTP Changes

Since its discovery in late 2021, DarkWatchMan campaigns have evolved in sophistication. Early campaigns used unencrypted libraries and basic phishing techniques, while recent campaigns employ encrypted payloads, advanced fileless techniques using .NET and PowerShell, and modular malware architecture. Delivery methods remain focused on spear-phishing with password-protected archives. The threat actor has adapted TTPs to evade detection and maintain persistence.

Note on TTP Variations:

While sources agree on the use of fileless techniques and phishing delivery, some differences exist in the description of payload encryption and persistence mechanisms. These variations likely reflect ongoing evolution and adaptation by the threat actor.

3. Victimology: Targeted Sectors, Regions, and Impacts

DarkWatchMan campaigns primarily target Russian critical infrastructure sectors, including energy, telecommunications, and transport. Other targeted sectors include finance, insurance, manufacturing, media, tourism, retail, and biotechnology. The campaigns have also impacted Ukraine and some European countries such as Poland and Belgium. The impacts include espionage, data theft, and potential disruption of critical services.

Note on Victimology Data:

Victimology data is consistent across sources, though detailed impact assessments are limited. No major public breach disclosures have been linked directly to DarkWatchMan, indicating either limited public reporting or successful containment.

4. Detection and Mitigation Strategies for Enterprises

Detection of DarkWatchMan requires monitoring for fileless malware behaviors, including unusual PowerShell and .NET activity, use of encrypted payloads, and spear-phishing with password-protected archives. Mitigation strategies include implementing advanced email filtering, endpoint detection and response (EDR) solutions capable of detecting fileless techniques, network segmentation, and user training on phishing awareness. Stakeholders should be informed of the evolving threat landscape and the need for investment in layered defenses.

Recommendations, Actions and Next Steps

  1. Deploy and Tune EDR/XDR Solutions for Fileless and Modular Malware Detection

    • Action: Implement advanced Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) platforms with behavioral analytics tuned to detect fileless malware techniques used by DarkWatchMan, such as PowerShell and .NET script execution, registry-based persistence, and modular payloads. Configure detection rules to alert on Office applications spawning PowerShell, encoded or obfuscated command-line arguments, and registry modifications for persistence. Integrate threat intelligence feeds with DarkWatchMan IOCs and regularly update detection logic as TTPs evolve.
    • Evidence: IBM X-Force and DC3 DCISE highlight the need for behavioral detection and endpoint monitoring to identify fileless and modular malware activity, noting that “enterprises should focus on detecting PowerShell and .NET script execution anomalies”. Threatpost details DarkWatchMan’s use of registry manipulation and fileless persistence.
    • Impact: Enables early detection and rapid response to advanced threats, reducing dwell time and risk of data theft or ransomware deployment.
    • Challenges: Requires investment in EDR/XDR, tuning to reduce false positives, and staff training on behavioral analytics.
    • Metrics: Number of detected fileless/script-based attacks, mean time to detect/respond, and reduction in successful malware persistence.
    • MITRE ATT&CK: T1059, T1027, T1055, T1112.

  2. Harden Email Security and Conduct Targeted Phishing Resilience Programs

    • Action: Deploy advanced email security gateways with sandboxing and content disarm/reconstruction to block phishing emails with password-protected archives. Enforce MFA for all remote access and critical applications. Launch regular, sector-specific phishing simulation campaigns and user training, focusing on tactics observed in Hive0117/DarkWatchMan campaigns (e.g., fake courier notifications, password-protected attachments).
    • Evidence: DC3 DCISE and Kaspersky ICS-CERT report that “phishing emails containing password-protected malicious archives” are the primary delivery vector for DarkWatchMan. IBM X-Force and Cybersecurity Advisors Network recommend “regular phishing awareness training and simulation”.
    • Impact: Reduces initial infection risk, increases user vigilance, and limits credential theft.
    • Challenges: User fatigue from frequent simulations, integration with legacy email systems, and ongoing training requirements.
    • Metrics: Phishing simulation failure rates, number of blocked phishing attempts, and user-reported phishing incidents.
    • MITRE ATT&CK: T1566, T1204.

  3. Enforce Network Segmentation and Restrict Script Execution in Critical Environments

    • Action: Architect network segmentation to isolate critical infrastructure, financial, and industrial systems from general user networks. Apply least privilege and application whitelisting to restrict PowerShell and .NET execution to trusted administrators. Develop and test incident response playbooks for fileless and modular malware, including rapid isolation and forensic triage procedures. Reference best practices for industrial network segmentation (e.g., Purdue Model).
    • Evidence: Kaspersky ICS-CERT and Threatpost emphasize the importance of network segmentation and restricting script execution to limit lateral movement and persistence. DC3 DCISE notes the need for “layered defenses and rapid containment” in response to evolving TTPs.
    • Impact: Limits the blast radius of successful attacks, supports rapid containment, and protects high-value assets.
    • Challenges: Complexity of segmenting legacy/OT environments, operational disruption risk, and need for regular playbook updates.
    • Metrics: Time to containment in incident response exercises, number of unauthorized script executions, and frequency of playbook reviews.
    • MITRE ATT&CK: T1070, T1486, T1562.

Suggested Pivots

  1. How have the TTPs of the Hive0117 group and DarkWatchMan malware evolved in 2025, specifically regarding the use of fileless techniques, encrypted payloads, and modular architectures, and what new detection challenges do these adaptations pose for critical infrastructure sectors?

  2. What specific infrastructure indicators such as domain registration data, passive DNS, and SSL certificate reuse can be analyzed to map the operational overlap between Hive0117 and DarkWatchMan campaigns, and how can this intelligence be operationalized to disrupt future phishing campaigns?

  3. Which advanced detection and mitigation strategies, including behavioral analytics focused on PowerShell and .NET script execution anomalies, multi-factor authentication enforcement, and network segmentation, have demonstrated effectiveness against DarkWatchMan's fileless malware, and what metrics should be used to evaluate their success in enterprise environments?

Forecast

Short-Term Forecast (3-6 months)

DarkWatchMan and the Hive0117 group will likely maintain and increase targeted phishing campaigns against Russian critical infrastructure sectors, including energy, telecommunications, and transport, as well as financial and industrial sectors in Eastern Europe. The primary attack vector will continue to be spear-phishing emails with password-protected archives, exploiting user trust and bypassing conventional email security. The malware’s fileless, modular architecture leveraging PowerShell and .NET will complicate detection, requiring enterprises to deploy advanced behavioral analytics and endpoint detection and response (EDR) solutions tuned for script execution anomalies and registry-based persistence. The reuse of domain registration data and C2 infrastructure by Hive0117 indicates operational persistence and adaptability. Organizations lacking layered defenses, including phishing resilience programs and network segmentation, will face elevated risk of espionage, data theft, and potential ransomware deployment as a secondary phase, consistent with DarkWatchMan’s observed capabilities and ransomware actor usage patterns.

Examples

  • Recent large-scale phishing campaigns by Hive0117 targeting Russian critical infrastructure and multiple industries, using password-protected archives and fileless malware (Industrial Cyber, 2025).
  • DarkWatchMan’s evolution to encrypted payloads and registry-based fileless persistence complicates detection (Threatpost, 2021; IBM X-Force, 2025).
  • Historical ransomware campaigns often use initial stealthy access tools like DarkWatchMan for foothold and lateral movement before deploying ransomware payloads.

What to Watch For

  • Increased volume and sophistication of spear-phishing emails with password-protected attachments targeting critical infrastructure and financial sectors.
  • Detection of anomalous PowerShell and .NET script executions, especially those involving registry modifications or obfuscated payloads.
  • Emergence or reuse of known Hive0117 C2 domains and infrastructure.
  • Reports of data exfiltration or ransomware incidents in sectors and regions consistent with DarkWatchMan targeting.

Long-Term Forecast (12-24 months)

DarkWatchMan and Hive0117 are expected to further refine their TTPs by integrating more advanced evasion techniques, such as multi-stage modular payloads, enhanced encryption, and possibly AI-assisted obfuscation, reflecting broader malware trends documented in recent threat intelligence. While direct evidence of AI-driven obfuscation by Hive0117 is not yet observed, the increasing adoption of AI by threat actors globally suggests this is a plausible evolution. The group may expand targeting beyond Eastern Europe to other geopolitically sensitive or financially lucrative regions, adapting to shifting geopolitical dynamics and defensive postures. Additionally, Hive0117 could diversify initial access vectors beyond spear-phishing, potentially incorporating supply chain compromises or exploiting zero-day vulnerabilities, as seen in other financially motivated APTs like FIN6 and Carbanak. Defensive strategies must evolve to include proactive threat hunting, automated response integration, and cross-sector intelligence sharing to disrupt Hive0117’s operational infrastructure and limit impact.

Examples

  • FIN6 and Carbanak groups evolved from phishing to supply chain and zero-day exploitation over time, increasing attack sophistication and impact.
  • Recent global trends show threat actors experimenting with AI to automate malware obfuscation and evade detection.
  • Hive0117’s operational overlap and infrastructure reuse suggest potential for collaboration or tool sharing with other threat groups, increasing attack complexity.

What to Watch For

  • Indicators of new delivery vectors such as supply chain attacks or exploitation of zero-day vulnerabilities linked to Hive0117 or DarkWatchMan.
  • Evidence of AI or machine learning techniques used in malware obfuscation or command-and-control communications.
  • Expansion of targeting to new geographic regions or sectors beyond current Eastern European focus.
  • Increased sharing or collaboration between Hive0117 and other financially motivated or nation-state threat actors.

MITRE ATT&CK IDs

T1059.001, T1566.001, T1027.011, T1070, T1204.002, T1036, TA0001, TA0002, TA0005, S0673, M1021, M1042, M1054

Appendix

References

AlphaHunt

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Have questions like this trying to put things into your SIEM??

  • DarkWatchMan campaign?
  • What are the specific technical capabilities and indicators of compromise (IoCs) associated with the DarkWatchMan malware?

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

(c) 2025 CSIRT Gadgets, LLC

MITRE ATT&CK

Techniques

  1. [T1059.001] Command and Scripting Interpreter: PowerShell – DarkWatchMan leverages PowerShell for fileless execution, persistence, and command execution, making this technique central to its operation and evasion strategies. IBM X-Force and Threatpost detail the malware’s use of PowerShell for stealthy, modular payload delivery and fileless persistence.

  2. [T1566.001] Phishing: Spearphishing Attachment – The primary initial access vector for DarkWatchMan is spear-phishing emails with password-protected archives, directly mapping to this technique. DC3 DCISE and Kaspersky ICS-CERT confirm the use of phishing attachments in DarkWatchMan campaigns.

  3. [T1027.011] Obfuscated Files or Information: Fileless Storage – DarkWatchMan stores data in the Windows Registry using fileless techniques to evade detection, aligning with this sub-technique. Picus Security and Threatpost highlight the use of fileless storage and obfuscation in DarkWatchMan’s operations.

  4. [T1070] Indicator Removal on Host – DarkWatchMan can uninstall malicious components from the Registry, stop processes, and clear browser history to remove indicators of compromise. This is confirmed by MITRE and referenced in the official software entry.

  5. [T1204.002] User Execution: Malicious File – The malware relies on users opening malicious files (e.g., password-protected archives) as part of its delivery mechanism, as described in DC3 DCISE and Kaspersky ICS-CERT reports.

  6. [T1036] Masquerading – DarkWatchMan has used icons mimicking text files to disguise malicious executables, supporting defense evasion. This is referenced in the MITRE ATT&CK software entry and supported by Threatpost.

Tactics

  1. [TA0001] Initial Access – DarkWatchMan campaigns begin with spear-phishing and malicious attachments to gain entry, as confirmed by DC3 DCISE and Kaspersky ICS-CERT.

  2. [TA0002] Execution – The malware uses PowerShell and .NET for fileless execution after initial access, as described in IBM X-Force and Threatpost.

  3. [TA0005] Defense Evasion – Fileless techniques, obfuscation, and indicator removal are used to evade detection, as documented in Picus Security and Threatpost.

Procedures

  1. [S0673] DarkWatchMan – The malware’s procedures include fileless persistence via the Registry, PowerShell-based execution, and modular payload delivery. These behaviors are described in IBM X-Force, Threatpost, and the MITRE ATT&CK software entry.

Software

  1. [S0673] DarkWatchMan – A lightweight, modular, fileless remote access tool (RAT) using JavaScript, .NET, and PowerShell, first observed in 2021. Its use in real-world campaigns is documented by MITRE, IBM X-Force, and Threatpost.

Mitigations

  1. [M1021] Restrict Web-Based Content – Use email and web content filtering to block phishing emails and malicious attachments. This is recommended by IBM X-Force and Kaspersky ICS-CERT.

  2. [M1042] Disable or Remove Feature or Program – Restrict or disable PowerShell and scripting environments for non-administrative users to reduce fileless malware risk, as recommended by IBM X-Force and Threatpost.

  3. [M1054] Software Configuration – Configure endpoint detection and response (EDR) solutions to monitor and alert on suspicious PowerShell and .NET activity, as recommended by IBM X-Force and DC3 DCISE.

Read more