DarkWatchMan and Hive0117: Fileless Malware Evolution Targeting Russian Critical Infrastructure

🚨 Russians are finally tasting their own file‑less soup: DarkWatchMan & its chef Hive0117 just slipped past AV with pure‑RAM PowerShell trickery, drilling into banks and power grids before anyone smelled smoke. Industrial Cyber says the phish wave started slamming Russian critical infra this spring, and The Hacker News labels the toolkit “nation‑grade stealth.”

Their secret sauce? Encrypted, modular payloads parked in the registry—no files, no forensics, just ghosts. If your EDR isn’t watching memory, you’re a 90’s mall cop guarding NFTs.

🔍 Question for CISOs: when the breach lives rent‑free in RAM, what’s your first move—segmentation, Sysmon, or prayer?

👉 Get a step‑by‑step hunt guide in today’s AlphaHunt brief—then smash subscribe before Hive0117 smashes you.

https://blog.alphahunt.io/darkwatchman-and-hive0117-fileless-malware-evolution-targeting-russian-critical-infrastructure

#AlphaHunt #CyberSecurity #ThreatIntel #FilelessMalware #SOC