Hive0117’s Malware Mischief: Russian Firms Fall for DarkWatchman Prank
In a plot twist worthy of a spy novel, the Hive0117 group has unleashed a new variant of the DarkWatchman malware on Russian firms. Just like an email from your long-lost uncle, these phishing attacks are as sneaky as ever. Even antivirus software is throwing its hands up in defeat.
Hot Take:
Looks like Hive0117 is taking a page out of the hacker’s handbook titled “How to Ruin Your Weekend.” Just when you thought it was safe to take a long holiday, this cybercrime group decided to gift Russian firms with a malware masquerade ball, featuring the new and improved DarkWatchman. Who needs a break when you can have a breach?
Key Points:
- Hive0117 is targeting a wide range of sectors in Russia with phishing attacks.
- The group is using a modified version of the DarkWatchman malware.
- The phishing campaign was detected by F6 Threat Intelligence on April 29, 2025.
- Emails were sent with the subject “Documents from 04/29/2025” to appear legitimate.
- The campaign strategically coincided with a long weekend to exploit reduced vigilance.
Already a member? Log in here