Back
December 23, 2021  —  Eric Swotinsky
Incident reports

Dark Watchman demonstrates evolution in fileless malware techniques

Cyber Protect Cloud
for service providers
View Live Demo

A new remote access Trojan (RAT) by the name of Dark Watchman uses fileless techniques and is mainly created in JavaScript. This makes it more stealthy.

Dark Watchman is stored in the Windows Registry as a script, and a scheduled task is created to launch it every time the user logs in. It also has a keylogger which is stored as obfuscated C# code, and compiled by a PowerShell script and the legitimate .NET CSC.exe tool.

The RAT can download and execute new payloads, run custom commands, upload files to a command-and-control server, and update its own code. There are indications that it does download ransomware.

The behavioral detection and machine intelligence capabilities in Acronis Cyber Protect effectively block both existing and brand-new malware threats, including fileless variants, before they can do any damage to your systems.

Eric Swotinsky

About Acronis

Acronis is a Swiss company, founded in Singapore. Celebrating two decades of innovation, Acronis has more than 2,000 employees in 45 locations. Acronis Cyber Protect solution is available in 26 languages in over 150 countries and is used by 18,000 service providers to protect over 750,000 businesses.

Cybersecurity Cyber protection Cyberthreats

More from Acronis

October 02, 2023  — 9 min read
Acronis
October 02, 2023  — 9 min read
BlackByte 3.0 uses vulnerable drivers to compromise systems
BlackByte is an example of ‘ransomware-as-a-service‘ (RaaS), and the threat actors behind it constantly upgrade their malware to keep customers satisfied. Recent changes have increased the complexity of cybersecurity analytics, while also introducing new anti-analysis and anti-debugging techniques.
September 08, 2023  — 4 min read
Acronis
September 08, 2023  — 4 min read
Acronis Cyberthreats Update, September 2023
The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis analysts and sensors. Figures presented here — including malware, URL and ransomware statistics — were gathered in August of this year and reflect threats that we detected as well as news stories from the public domain.
August 08, 2023  — 8 min read
Acronis
August 08, 2023  — 8 min read
Acronis Cyberthreats Report, August 2023
The Acronis Cyberthreats Report covers current cyberthreat activity and trends, as observed by Acronis analysts and sensors. Figures presented here — including malware, URL and ransomware statistics — were gathered in July of this year and reflect threats that we detected as well as news stories from the public domain.
August 04, 2023  — 2 min read
Acronis
August 04, 2023  — 2 min read
AV-TEST: Another top score for Acronis Cyber Protect in macOS evaluation
Acronis Cyber Protect Cloud with Advanced Security has once again been evaluated by the renowned independent German testing laboratory AV-TEST. Just as in previous evaluations, the solution received a perfect score of 18/18 points. These consistently perfect results, despite an ever-evolving threat landscape, are demonstrative proof that Acronis Cyber Protect Cloud is well-equipped to protect macOS users.