Loading story…
Attackers used compromised Microsoft 365 accounts to deliver DarkGate Loader through Microsoft Teams external chat, shifting away from traditional email-based malware delivery. In the observed campaign, HR-themed messages lured recipients into opening a SharePoint-hosted ZIP archive named Changes to the vacation schedule.zip, which contained a malicious .lnk file. That shortcut launched a VBScript downloader that fetched additional components, including a renamed cURL binary, AutoIt3.exe, and an AutoIT script that ultimately deployed DarkGate in memory.
Analysis showed the AutoIT stage checked for Sophos antivirus before deobfuscating shellcode and reconstructing the final Windows payload, while Microsoft Defender identified the ZIP-delivered malware as BAT/Tisifi.A# and VirusTotal linked the final payload to DarkGateLoader. The campaign also highlighted a defensive gap: Microsoft Teams protections such as Safe Attachments and Safe Links did not stop the attack path, underscoring the need for administrators to tighten Teams external chat settings and restrict communication to trusted organizations and domains.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The two Microsoft 365 accounts used to send the malicious Teams messages were reportedly put up for sale on the dark web in August 2023.
In August 2023, attackers used compromised Microsoft 365 accounts to send HR-themed Microsoft Teams external chat messages linking to SharePoint-hosted ZIP files that delivered DarkGate Loader. The campaign used lures such as "Changes to the vacation schedule.zip" and bypassed Teams Safe Links and Safe Attachments according to the analysis.
DarkGate malspam activity increased after its author advertised DarkGate as a malware-as-a-service offering on cybercrime forums in June 2023.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DarkGate has emerged as a versatile **malware-as-a-service** loader and remote access trojan used by multiple threat actors, including **TA577**, **Ducktail**, **UNC2975**, and **UNC5085**, with campaigns delivering it through large-scale email waves, fake browser updates, VBScript loaders, MSI installers, and messaging platforms such as **Skype** and **Microsoft Teams**. Proofpoint reported one major cluster, dubbed **BattleRoyal**, using DarkGate in attacks against organizations in the United States and Canada, relying on traffic distribution systems including **404 TDS** and **Keitaro TDS** and abusing malicious `.URL` files tied to **`CVE-2023-36025`** to bypass Windows SmartScreen protections before later shifting some activity to NetSupport. Technical analyses describe DarkGate as a mature platform with broad post-compromise capabilities, including reverse shell access, **PowerShell** execution, keylogging, credential and token theft, hidden **VNC** remote control, privilege escalation, persistence, file management, and even **XMRig**-based Monero mining. Researchers said the malware continues to evolve its evasion and execution methods through custom Base64 and XOR-obfuscated configuration data, HTTP POST command-and-control, alternate ports such as `2351` and `9999`, dynamic API resolution, parent PID spoofing, APC injection via **`NtTestAlert`**, DLL side-loading, AutoIt-based execution, and LOLBAS abuse through **`extexport.exe`**, underscoring DarkGate’s ongoing role as a significant cybercrime threat.
Aug 15, 2026
Researchers published new technical findings on **DarkGate**, showing that defenders can recover key operational data from recent versions of the Windows malware. Kroll reported that DarkGate `5.2.3` uses a flawed method to randomize its custom Base64 alphabet: the shuffle seed is derived from the sum of bytes in a 32-byte hardware ID, reducing the search space to just **1,248** possible alphabets. That weakness allows analysts to brute-force and decode on-disk configuration files and keylogger output without first obtaining the victim-specific hardware ID, exposing details such as domains, ports, versioning, campaign settings, and captured user input. Separate analysis from DCSO CyTec showed that newer DarkGate keylogger logs can also be decrypted by reconstructing the malware’s bot ID from host attributes and the `internal_mutex` value, then deriving the AES/Rijndael key despite DarkGate’s custom Delphi cryptographic implementation. A separate campaign analysis traced how DarkGate was delivered through a **malicious PDF lure** that led victims to download `build-x64.msi`, an installer signed with a valid certificate. The MSI executed a custom action DLL and abused DLL sideloading via a legitimate `iTunesHelper.exe` binary to load a malicious `CoreFoundation.dll`, which decrypted data from `sqlite3.dll` using the XOR key `VzXLKSZE`, extracted AutoIt components into `c:\temp`, and launched a shellcode loader followed by a Delphi-based in-memory loader. The final payload was identified as DarkGate `6.1.9`, with extracted configuration including C2 domain `prodomainnameeforappru.com`, port `443`, campaign ID `admin888`, persistence enabled, and multiple anti-VM and environment checks; the delivery domain `selectwendormo9tres[.]com` had already been sinkholed at the time of analysis.
Aug 15, 2026
Researchers detailed multiple **DarkGate** infection chains that began with phishing lures themed as invoices or DocuSign documents and pushed victims toward malicious `CAB` and `MSI` installers. In one case, a wrapped DoubleClick ad URL delivered an `MSI` signed with a valid certificate issued to **“Inoellact EloubantTech Optimization Information Co., Ltd.”**, helping the malware evade reputation checks. The installer unpacked a cabinet containing legitimate signed binaries alongside tampered DLLs, enabling **DLL sideloading** and staged decryption before launching the next payload. Analysis showed DarkGate using a layered loader architecture built around Delphi components and **AutoIt** scripts to reconstruct shellcode in memory and execute the final malware. One chain used a legitimate Apple binary with a modified `CoreFoundation.dll` and an encrypted `sqlite3.dll`; another abused `windbg.exe` in a similar sideloading flow. The recovered payload was the **DarkGate** agent, a malware-as-a-service loader capable of remote access and follow-on malware delivery, and one sample communicated with `prodomainnameeforappru[.]com` (`46.21.157.142`) over port `443`.
Aug 15, 2026