15-09-2026
In Trouble Again: The Hive0117 Group Has Returned with New Malware for Attacks on Accountants
https://www.f6.ru/blog/fmvt-rat/
Report completeness: High
Actors/Campaigns:
Watch_wolf (motivation: financially_motivated)
Threats:
Darkwatchman
Com_hijacking_technique
Shadow_copies_delete_technique
Lobshot
Hvnc_tool
Victims:
Financial departments, Accountants, Retail, Construction, Logistics and transportation, Manufacturing, Tourism, Education, Healthcare, Fuel and energy sector, have more...
Industry:
Logistic, Petroleum, Education, Energy, Transport, Retail, Financial, Healthcare
Geo:
Russian, Belarus, Russia, Kazakhstan, Uzbekistan
ChatGPT TTPs:
do not use without manual checkT1010, T1012, T1027, T1027.013, T1036, T1041, T1057, T1070.004, T1074.001, T1112, have more...
IOCs:
File: 26
Command: 4
IP: 6
Url: 1
Registry: 2
Hash: 44
Soft:
Telegram, VKontakte, Viber, WhatsApp, Chrome, Windows registry, Windows Defender, Google Chrome, Yandex Browser, Chromium, have more...
Algorithms:
xor, sha1, fnv-1a
Functions:
ReflectiveEntryPoint32
Win API:
CoCreateGuid, CreateProcessW, LoadLibrary
Languages:
javascript, php, powershell