Loading threat actor…
RastaFarEye is the underground developer and operator associated with the DarkGate malware-as-a-service platform. DarkGate is a long-running remote access trojan and crimeware framework first observed in 2018 and later commercialized through a subscription-based MaaS model. RastaFarEye is known for iterative development of DarkGate, including rapid feature changes and anti-detection updates in response to public analysis and defensive tooling. DarkGate has evolved across multiple major versions, including 4.x, 5.x, and 6.x, with delivery and execution chains using scripts, installer packages, AutoIt-based loaders, shellcode, in-memory PE loading, and DLL sideloading. Observed capabilities include credential theft, browser data theft, keylogging, screen capture, persistence, privilege escalation, process injection, process hollowing, parent PID spoofing, and extensive defense-evasion logic. Anti-analysis features have included anti-VM, anti-sandbox, debugger, environment, memory, and disk checks, as well as userland unhooking of NTDLL. Some versions also incorporated logic intended to bypass endpoint security products. DarkGate campaigns have used social-engineering-driven initial access and multistage loaders, including abuse of collaboration platforms and cloud-hosted payload delivery. Later variants have demonstrated modular execution chains and in-memory deployment designed to reduce forensic visibility. Version 5 introduced revised loaders and DLL sideloading, while version 6 samples showed heavily obfuscated AutoIt stages, RC4 and LZNT1-protected payload handling, and process hollowing into legitimate Windows processes. DarkGate has also been observed alongside other credential-theft malware, indicating flexible affiliate tradecraft under the MaaS model. Historically, DarkGate samples and advertising have referenced functions associated with ransomware deployment and cryptocurrency mining, but the actor is primarily characterized as a financially motivated cybercrime operator centered on access, theft, and post-compromise monetization. Telemetry indicates global victimization, with notable activity in the United States, Germany, Italy, Malaysia, and Singapore. RastaFarEye appears to maintain a relatively exclusive but expanding customer base of affiliates or buyers rather than operating as a broad commodity malware distributor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
155 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Developer and operator behind the DarkGate malware-as-a-service offering, continuously updating the malware to improve evasion, anti-analysis, delivery, and endpoint security bypass capabilities for customers conducting global compromises.
Identified as the known operator and developer behind the DarkGate MaaS platform.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.