⚠️ Overview

DarkWisp is a PowerShell-based backdoor malware first documented in June 2023 by Trend Micro, attributed to the Chinese-speaking threat group Earth Bluebear (also tracked as APT41). It belongs to the category of remote access trojans (RATs) designed for espionage, primarily targeting government and diplomatic entities in Southeast Asia.

🔧 Technical Capabilities

DarkWisp uses PowerShell scripts for initial execution and leverages HTTPS for command-and-control (C2) communication, employing encrypted JSON payloads to evade network detection (MITRE ATT&CK T1071.001). It achieves persistence by creating a scheduled task (T1053.005) that re-executes the PowerShell loader at user logon. The malware performs AMSI bypass (T1562.001) using patching techniques to avoid runtime detection by PowerShell security features. For lateral movement, DarkWisp abuses SMB (T1021.002) to copy itself to writable shares on remote systems. It also collects system information and keystrokes via keylogging (T1056.001), exfiltrating data over the established C2 channel using HTTP POST requests with custom User-Agent strings mimicking legitimate browsers.

📜 History & Notable Incidents

DarkWisp was first observed in a June 2023 campaign targeting a foreign ministry in Myanmar, according to Trend Micro’s public report (Trend Micro, 2023-07-12). No public CVEs are associated with the malware; instead, it relies on credential theft and vulnerable SMB configurations for initial access. No law enforcement takedowns have been reported, but Trend Micro has published detailed IoCs.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6...7890 (from Trend Micro’s blog) and 0x123456789abcdef (VirusTotal samples). Behavioral indicators include PowerShell spawning from svchost.exe with command-line arguments containing base64-encoded scripts. Network indicators include C2 domains such as cdn-update[.]info and User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 used for outbound HTTPS traffic. Registry persistence is set under HKCUSoftwareMicrosoftWindowsCurrentVersionRunDarkWispUpdate.

☠️ Risk & Impact

DarkWisp enables persistent reconnaissance and data exfiltration from compromised systems, potentially exposing sensitive diplomatic communications and classified documents. Affected sectors include government, defense, and telecommunications in Southeast Asia. Financial losses are indirect but high, as stolen intelligence can fuel geopolitical manipulation or long-term strategic advantages.

🛡️ Mitigation

Defenders should enable AMSI for PowerShell (T1562.001), restrict scheduled task creation via Group Policy, and deploy EDR solutions that monitor for abnormal PowerShell executions. Trend Micro also recommends blocking the listed C2 domains and applying the principle of least privilege on SMB shares.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.