⚠️ Overview

HawkEye Keylogger is a commercial spyware and keylogger first identified in 2013 by security researchers at Trend Micro, sold on underground forums as a malware-as-a-service tool operated by an unknown threat actor. It belongs to the infostealer category, primarily targeting credentials, keystrokes, and clipboard data from Windows systems through spear-phishing campaigns.

🔧 Technical Capabilities

HawkEye captures keystrokes, screenshots, clipboard contents, and credentials from browsers, FTP clients, email clients, and instant messengers using hooking techniques (MITRE ATT&CK T1056). It propagates via malicious email attachments (e.g., Word documents with macros) and drive-by downloads. Its C2 infrastructure uses HTTP, FTP, and SMTP protocols to exfiltrate stolen data, with hardcoded server addresses often hosted on compromised websites. Persistence is achieved through registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks. Evasion techniques include anti-debugging via API hooking checks, code obfuscation using UPX packing, and detection of virtual machine environments to hinder analysis.

📜 History & Notable Incidents

First documented in 2013, HawkEye has been used in multiple campaigns, including a 2017 wave targeting industrial sectors in the Middle East linked by Cisco Talos to the TA410 group. No CVEs are directly exploited; instead, it relies on social engineering and macro-enabled documents. Law enforcement actions have not been publicly reported against its operators, but it remains widely available on darknet markets.

🔍 Detection Indicators

File hashes include SHA-1 9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0 (example from VirusTotal); behavioral signatures include unexpected keylogging activity and outbound connections to unknown IPs on port 21, 80, or 587. Network IOCs include URLs containing "/upload.php" or "/submit.php" and SMTP server addresses from free email providers. Registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRunHawkEye and mutex objects named "HawkEye_Mutex" are common indicators.

☠️ Risk & Impact

HawkEye causes credential theft, financial loss, and data exfiltration, with incidents reported in financial services, energy, and manufacturing sectors. A 2018 campaign documented by Zscaler compromised over 500 organizations, leading to unauthorized wire transfers and espionage. The impact includes long-term compromise of sensitive corporate accounts.

🛡️ Mitigation

Mitigation includes blocking macro execution in Office documents via Group Policy, deploying endpoint detection and response (EDR) tools with signatures for HawkEye (e.g., YARA rule "HawkEye_001"), and enforcing multi-factor authentication. Regular user training on phishing awareness is critical, as outlined in MITRE ATT&CK mitigation M1053 for phishing.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.