Cybercriminals target accountants to drain Russian firms’ bank accounts

Hive0117 conducted a large phishing campaign in Feb–Mar 2026 targeting accountants at over 3,000 Russian organizations to deliver DarkWatchman RAT via password‑protected archives; compromised machines were used to create fraudulent payroll payment orders that routed funds to attacker-controlled accounts, resulting in confirmed thefts (the largest >14M rubles). The campaign leveraged likely-compromised legitimate senders and tailored messages to finance staff, allowing attackers to bypass anti-fraud controls and move laterally within victim networks.