DarkWatchman

First seen

2021-11-01 00:00:00

Malware type

rat, keylogger

Family

Malware family

Operating systems

windows

Related IoCs

823 (822 malicious)

Last IoC activity

2026-09-01 20:32:36

Profile updated

2026-07-07 13:16:16

Targeted industries: financial-services technology-and-telecommunications

Context

DarkWatchman is a lightweight JavaScript-based remote access tool (RAT) that avoids file operations; it was first observed in November 2021.

Recent IoC activity

823 malicious indicators in Maltiverse are attributed to DarkWatchman (S0673). The 20 most recently updated:

Detection coverage

• 690 Sigma rules

Malware & tools used

• File Deletion (attack-pattern)
• Fileless Storage (attack-pattern)
• Compression (attack-pattern)
• Modify Registry (attack-pattern)
• Inhibit System Recovery (attack-pattern)
• Local Data Staging (attack-pattern)
• Application Window Discovery (attack-pattern)
• PowerShell (attack-pattern)
• System Time Discovery (attack-pattern)
• File and Directory Discovery (attack-pattern)
• Command Obfuscation (attack-pattern)
• Domain Generation Algorithms (attack-pattern)
• Query Registry (attack-pattern)
• Shared Modules (attack-pattern)
• Browser Information Discovery (attack-pattern)
• Standard Encoding (attack-pattern)
• Windows Command Shell (attack-pattern)
• Asymmetric Cryptography (attack-pattern)
• Web Protocols (attack-pattern)
• Data from Local System (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• Windows Management Instrumentation (attack-pattern)
• Spearphishing Attachment (attack-pattern)
• Compile After Delivery (attack-pattern)
• Scheduled Task (attack-pattern)

Reports & references

• securityintelligence.com — Hive00117 Fileless Malware Delivery Eastern Europe (report)
• malpedia.caad.fkie.fraunhofer.de — Js.Darkwatchman (report)
• cyble.com — Sophisticated Darkwatchman Rat Spreads Through Phishing Sites (report)
• intrinsec.com — Intrinsec 2025 Threat Report Trouble In The Air (report)
• securityintelligence.com — New Hive0117 Phishing Campaign Imitates Conscription Summons Deliver Darkwatchman Malware (report)
• prevailion.com — Darkwatchman New Fileness Techniques (report)
• MITRE ATT&CK — S0673 (report)
• web.archive.org — Darkwatchman New Fileless Techniques (report)

External references

• mitre-attack — S0673
• Prevailion DarkWatchman 2021
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy