Cyble – Sophisticated DarkWatchMan RAT Spreads Through Phishing Sites

MITRE Techniques

• [T1566] Phishing – The phishing website imitates CryptoPro CSP to trick users into downloading malicious content. Quote: “phishing attacks pose an ongoing and widespread danger… attackers often use fraudulent websites to distribute their malicious software.”
• [T1059.001] PowerShell – The malware launches PowerShell with hidden execution to bypass user visibility. Quote: “…start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath …”
• [T1059.005] Windows Script – The JavaScript is executed via Windows Script Host (wscript.exe). Quote: “…start /MIN wscript.exe /E:jscript 144039266 131 ‘C:UsersUser ProfileDesktopCSPCSPSetup.exe’…”
• [T1564.001] Hide Artifacts: Hidden Window – The command uses hidden windows to avoid user awareness. Quote: “…-W Hidden…”
• [T1140] Deobfuscate/Decode Files or Information – The keylogger is encrypted/encoded and later decrypted and stored. Quote: “decrypts the keylogger code and stores in registry.”
• [T1053] Scheduled Task/Job – A task scheduler entry is created to run the copied script at startup. Quote: “task scheduler entry … to run the copied script every time the system starts up.”
• [T1012] Query Registry – UID is obtained by reading a registry value. Quote: “obtaining a unique identifier (UID) … by accessing a specific registry value… HKEY_LOCAL_MACHINE…MachineGuid.”
• [T1082] System Information Discovery – The malware collects OS version, locale, computer name, username, domain role, and antivirus. Quote: “collects the victim’s system information, such as operating system version, locale, computer name, username, domain role, and antivirus software.”
• [T1087] Account Discovery – Checks administrative privileges via registry-based checks. Quote: “Is_admin… determines whether the user has administrative privileges on the system.”
• [T1056.001] Input Capture: Keylogging – The RAT implements a keylogger and captures keystrokes and clipboard data. Quote: “The keylogger records keystrokes, clipboard data, and smart card information in the registry…”
• [T1071] Command and Control: Application Layer Protocol – Data is sent to and retrieved from a C2 server; fallback mechanisms exist. Quote: “The RAT regularly retrieves and clears the buffer before transmitting the captured keystrokes to the C&C server.”