DarkWisp

First seen
2022-06-15 00:00:00
Malware type
backdoor, spyware
Family
Malware family
Profile updated
2026-07-07 13:16:03

Targeted industries: government-and-public-sector technology-and-telecommunications financial-services

Context

According to Trend Micro, DarkWisp is a PowerShell-based backdoor and reconnaissance utility designed for unauthorized system access and intelligence gathering. It enables attackers to exfiltrate sensitive data while maintaining persistent control over the compromised system. The malware collects extensive information about the compromised system to create a detailed profile. It determines whether the user has administrative privileges, checks for membership in a corporate domain, and identifies the presence of cryptocurrency wallets or VPN software by scanning specified directories and applications. It also gathers data about the system's operating environment, including public IP address, geographic location, installed antivirus products, firewall status, and system uptime. This information is compiled into a structured format and transmitted to the C&C server.

Reports & references

  • Trend Micro — Deep Dive Into Water Gamayun (report)
  • malpedia.caad.fkie.fraunhofer.de — Ps1.Dark Wisp (report)

External references