The Hidden Network: Unmasking the DarkGate Operator’s Malware Distribution Tactics

Report: DarkGate Malware Campaign Exploiting Skype and Teams Accounts

Overview

A recent report by cybersecurity firm Trend Micro highlights a concerning malware campaign involving the distribution of DarkGate, a versatile loader associated with various malicious activities. The campaign, which started in August, has targeted organizations in the Americas. Trend Micro’s research reveals that the developer of DarkGate has begun advertising the malware on underground forums and offering it as a service to affiliate threat actors, leading to an increase in DarkGate activity after a period of relative inactivity.

The Method of Distribution

The DarkGate operator has adopted a new strategy of using compromised Skype and Teams accounts to distribute the malware. In one attack, the threat actor gained control of a trusted Skype account, using it to send a message disguised as a PDF file but containing a malicious VBS script. When the recipient executed the file, DarkGate was downloaded and installed on their computer. Another attack involved the use of a Teams account and a malicious .LNK file. The recipients of this attack received the message from an unknown, external entity. In both cases, the goal was to exploit the recipient’s trust in the sender and trick them into executing the malicious file.

DarkGate‘s Capabilities

DarkGate is a sophisticated malware that has been active since at least 2017. It possesses various potent functions, including the ability to execute commands for gathering system information, mapping networks, and conducting directory traversal. DarkGate also incorporates remote desktop protocol, hidden virtual network computing, AnyDesk, and other remote access software. Additionally, it includes features related to cryptocurrency mining, keylogging, privilege escalation, and stealing information from browsers. DarkGate employs AutoIT, a legitimate Windows automation and scripting tool, for payload delivery and execution, making detection and evasion more challenging.

Potential Payloads

Trend Micro’s analysis reveals that DarkGate drops additional payloads once it infects a system. These payloads can be variants of DarkGate itself or Remcos, a remote access Trojan previously used for cyber-espionage and stealing tax-related information. As DarkGate‘s developer now offers the malware as a service, enterprises can expect attacks from various threat actors, with different objectives. These objectives range from ransomware attacks to cryptocurrency mining, depending on the group using DarkGate.

Protective Measures

While Trend Micro successfully mitigated the DarkGate attacks it observed, organizations must remain vigilant and proactively protect their systems. Trend Micro recommends the following measures:

1. Enforce rules regarding the use of instant messaging applications like Skype and Teams, including blocking external domains and controlling the use of attachments.
2. Implement scanning measures for attachments if possible.
3. Consider implementing multifactor authentication to prevent unauthorized access to instant messaging accounts.

Analysis and Editorial

The DarkGate malware campaign highlights the evolving nature of cyber threats and the need for organizations to continuously adapt their security measures. The use of compromised Skype and Teams accounts demonstrates how threat actors exploit trusted communications channels to distribute malware. It is imperative for organizations to educate their employees about the risks associated with unsolicited files or messages and ensure robust security protocols are in place to detect and prevent such attacks.

The emergence of DarkGate as a malware-as-a-service offering is troubling since it allows multiple threat actors to use the tool, potentially leading to a wider range of malicious activities. This development requires organizations to remain vigilant against various types of malware and strengthen their defenses accordingly.

Additionally, this campaign highlights the importance of strong password management and multifactor authentication. Illegally obtained credentials play a significant role in enabling threat actors to exploit accounts and distribute malware. By implementing multifactor authentication, organizations can enhance the security of their systems and prevent unauthorized access.

In conclusion, the DarkGate malware campaign serves as a stark reminder of the ever-present cyber threats organizations face. Vigilance, education, and proactive security measures are crucial to protect against evolving malware distribution tactics. By adopting these measures, organizations can mitigate the risk of falling victim to DarkGate and other similar malicious campaigns.