DarkGate malware loader into limelight

Researchers have seen a spike in the distribution of DarkGate, a sophisticated malware that spreads through a phishing campaign using compromised Microsoft Teams accounts.

Active since 2017, DarkGate has been relatively unknown until the middle of this year when the distribution of an enhanced version of the malware was observed through email phishing and malvertising campaigns.

Researchers have identified that Microsoft 365 accounts sending teams chat messages with links to malicious files as part of a phishing campaign with a DarkGate loader as the payload.

The victims were prompted to open a ZIP file purportedly containing a changed staff vacation schedule for their organization. The ZIP file contained a malicious LNK file disguised as a PDF document. If clicked on, it ultimately resulted in DarkGate malware being executed on the target system.

Right now, the only way to prevent this attack vector within Microsoft Teams is to only allow Microsoft Teams chat requests from specific external domains, albeit it might have business implications since all trusted external domains need to be whitelisted by an IT administrator. Said the researcher.

Two months earlier, ZeroFox circulated a dark web forum post by a threat actor calling themselves “RastaFarEye” who appeared to be the developer of DarkGate.

The poster said they had spent over 20,000 hours since 2017 developing the malware which they described as “the ultimate tool for pentesters/redteamers”.

The threat actor said they were offering DarkGate to a small number of new affiliates and had “4/10 slots available”. The non-negotiable price to use the malware was $1000 for a day, $15,000 for a month, or $100,000 for a year.

While it is possible the recent spike in attacks may be linked to threat actors responding to RastaFarEye’s bid to hire out DarkGate as a ransomware-as-a-service offering, it is not known whether any threat actors have taken up the offer to become affiliates for $100,000 a year asking price.

This research was documented by researchers from TrueSec.

Indicators of Compromise

• 0c59f568da43731e3212b6461978e960644be386212cc448a715dbf3f489d758
• bcd449470626f4f34a15be00812f850c5e032723e35776fb4b9be6c7be6c8913
• 4c21711de81bb5584d35e744394eed2f36fef0d93474dfc5685665a9e159eef1
• 1bcde4d4613f046b63e970aa10ea2662d8aa7d326857128b59cb88484cce9a2d
• hXXps://burapha-my[.]sharepoint[.]com/:u:/g/personal/63090101_my_buu_ac_th/EWkB0l3nR4dCjDmwAe7jb7kBWPPkDObt8wVbmB1O6UztmA
• hXXps://unadvirtualedu-my[.]sharepoint[.]com/personal/adriverar_unadvirtual_edu_co/Documents/Microsoft%20Teams%20Chat%20Files/Changes%20to%20the%20vacation%20schedule.zip
• hXXp://5[.]188[.]87[.]58:2351/wbzadczl
• hXXp:// 5[.]188[.]87[.]58:2351/msiwbzadczl
• hXXp://5[.]188[.]87[.]58:2351