“DarkWatchman”, a new remote access Trojan (RAT), was recently identified by Prevailion’s Adversarial Counterintelligence Team (PACT) and observed to have fileless persistence. Researchers detailed that the JavaScript-based RAT is paired with a C# keylogger, distributed via spear-phishing campaigns, and utilizes a Domain Generation Algorithm (DGA), which generates a large number of domain names to be used as rendezvous points, in order to identify its command-and-control (C2) servers. DarkWatchman was observed utilizing the Windows registry for the majority of temporary and permanent storage rather than the disk, which allows it to bypass most detection security tools. The researchers declared that the RAT “represents an evolution in fileless malware techniques” and provided a full technical analysis of the Russian-language email lures. PACT did not confirm attribution of DarkWatchman but did reveal that the current targeted victims appear to be within Russia, its lure documentation and code comments are written in Russian, the mail servers utilized are within Russia, and the initial posting regarding an ongoing lure was on a Russian automotive forum. PACT’s in-depth analysis can be viewed in their report linked below.