HawkEye

HawkEye is a spyware program that includes multiple features for collecting information such as keylogger attacks. Since HawkEye is easily reconfigurable and is available to third-party criminals at a fee, its installation exploits may be unconventional, and its information-collecting goals may vary per attack. Users always should treat it as a high-level threat and have their anti-malware services remove HawkEye as quickly as possible.

An Avian Eye that Hasn't Blinked Since 2013

Six years ago marks the 'birth' of a spyware-for-hire service on Black Hat websites: HawkEye, which specializes in exfiltrating confidential information. While that degree of age would, usually, indicate that it's fallen out of favor by becoming defunct, its threat actors continue updating it, even to the date of this article's writing. Updates of HawkEye, such as HawkEye Reborn v9, still are grafting on features for the convenience of criminals, with an emphasis on AV avoidance and stealth.

HawkEye offers multiple tiers for renting it out by the day, month, or year, although all subscription options are highly affordable, by the standards of the spyware black market. Threat actors can circulate it however they choose, although malware researchers, unsurprisingly, note a relationship between HawkEye campaigns and e-mail attachments. The latter may hide as invoices or other documentation that's specifically-crafted for the target business, NGO or government.

Whichever method HawkEye uses for infiltrating a PC, it proceeds with leveraging multiple features for monitoring and then exfiltrating information. Along with the keylogging, or recording of keyboard keystrokes, it collects data from most Web browsers, FTP clients like CoreFTP and Filezilla, and some gaming applications like Mojang's Minecraft. Like other, advanced spyware, it can record the webcam, as well, or capture images of the screen display. Its payload is a fully-fledged package for collecting information.

Shooting Down the HawkEye in the Sky

While it has many strengths to recommend it to criminals, HawkEye's infection strategies are, often, prosaic. Victims of infections could avoid its attacks by scanning their e-mails for threats, by updating document reader software for patching out vulnerabilities, and by leaving Word macros inactive, as they are by default. Because its access to information is all but unrestricted, preventing a HawkEye infection is much simpler than re-securing all the credentials that it could collect afterward.

Like any threat that transfers information back and forth between its Command & Control server and the compromised system, users should barricade HawkEye's communications as soon as they suspect infection. Disabling network connections, preventing any sharing of removable devices, and scanning the affected system with appropriate anti-malware solutions are essential steps for recovery. After removing HawkEye, users should remember the need for changing all passwords, security questions, and other details that it might have had access to collecting.

HawkEye is capitalism operating illicitly – a business that breaks the law every time it makes money. For now, that's not proving nearly as much of an impediment to its success as the proper security standards are.