DarkWisp
- First seen
- 2022-06-15 00:00:00
- Malware type
- backdoor, spyware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:16:03
Targeted industries: government-and-public-sector technology-and-telecommunications financial-services
Context
According to Trend Micro, DarkWisp is a PowerShell-based backdoor and reconnaissance utility designed for unauthorized system access and intelligence gathering. It enables attackers to exfiltrate sensitive data while maintaining persistent control over the compromised system. The malware collects extensive information about the compromised system to create a detailed profile. It determines whether the user has administrative privileges, checks for membership in a corporate domain, and identifies the presence of cryptocurrency wallets or VPN software by scanning specified directories and applications. It also gathers data about the system's operating environment, including public IP address, geographic location, installed antivirus products, firewall status, and system uptime. This information is compiled into a structured format and transmitted to the C&C server.
Reports & references
- Trend Micro — Deep Dive Into Water Gamayun (report)
- malpedia.caad.fkie.fraunhofer.de — Ps1.Dark Wisp (report)