DarkWatchman cybercrime malware returns on Russian networks

Researchers observed the financially motivated actor Hive0117 conducting phishing campaigns against Russian companies in media, tourism, biotech, finance, energy and telecoms using modified DarkWatchman malware delivered via password-protected malicious archives; the malware can log keystrokes, harvest data and deploy further payloads, though it is unclear whether recent attacks resulted in successful compromise or financial loss.