Loading story…
Researchers detailed multiple DarkGate infection chains that began with phishing lures themed as invoices or DocuSign documents and pushed victims toward malicious CAB and MSI installers. In one case, a wrapped DoubleClick ad URL delivered an MSI signed with a valid certificate issued to “Inoellact EloubantTech Optimization Information Co., Ltd.”, helping the malware evade reputation checks. The installer unpacked a cabinet containing legitimate signed binaries alongside tampered DLLs, enabling DLL sideloading and staged decryption before launching the next payload.
Analysis showed DarkGate using a layered loader architecture built around Delphi components and AutoIt scripts to reconstruct shellcode in memory and execute the final malware. One chain used a legitimate Apple binary with a modified CoreFoundation.dll and an encrypted sqlite3.dll; another abused windbg.exe in a similar sideloading flow. The recovered payload was the DarkGate agent, a malware-as-a-service loader capable of remote access and follow-on malware delivery, and one sample communicated with prodomainnameeforappru[.]com (46.21.157.142) over port 443.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Netskope said DarkGate was first reported by enSilo, now Fortinet, in 2018. This establishes the earliest dated reference point in the story.
Runtime analysis in the SANS ISC diary identified the final payload as the DarkGate agent, mapped into a spawned VBC.exe process. The malware beaconed to prodomainnameeforappru[.]com, which resolved to 46.21.157.142 on port 443.
A SANS ISC guest diary analyzed a DarkGate infection chain starting from a phishing PDF that used a fake load error and an Open button to fetch a malicious MSI through a wrapped DoubleClick ad URL. The MSI was signed with a valid certificate and unpacked files used for DLL sideloading, decryption, and staged execution.
Netskope assessed its samples as part of a new DarkGate version that used a loading approach resembling Cobalt Strike Beacon’s default shellcode stub. It also published detections, IOCs, scripts, and YARA rules for the campaign.
Netskope Threat Labs analyzed a DarkGate campaign that began with a fake invoice email and DocuSign-themed PDF lure, leading to a CAB file, then an MSI, and a multi-stage loading chain. The campaign used DLL sideloading with windbg.exe, Delphi loaders, and an AutoIt stage to execute the final DarkGate payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
3 references tracked. Mallory keeps watching after this page renders.
dshield.org
Open sourcenetskope.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers published new technical findings on **DarkGate**, showing that defenders can recover key operational data from recent versions of the Windows malware. Kroll reported that DarkGate `5.2.3` uses a flawed method to randomize its custom Base64 alphabet: the shuffle seed is derived from the sum of bytes in a 32-byte hardware ID, reducing the search space to just **1,248** possible alphabets. That weakness allows analysts to brute-force and decode on-disk configuration files and keylogger output without first obtaining the victim-specific hardware ID, exposing details such as domains, ports, versioning, campaign settings, and captured user input. Separate analysis from DCSO CyTec showed that newer DarkGate keylogger logs can also be decrypted by reconstructing the malware’s bot ID from host attributes and the `internal_mutex` value, then deriving the AES/Rijndael key despite DarkGate’s custom Delphi cryptographic implementation. A separate campaign analysis traced how DarkGate was delivered through a **malicious PDF lure** that led victims to download `build-x64.msi`, an installer signed with a valid certificate. The MSI executed a custom action DLL and abused DLL sideloading via a legitimate `iTunesHelper.exe` binary to load a malicious `CoreFoundation.dll`, which decrypted data from `sqlite3.dll` using the XOR key `VzXLKSZE`, extracted AutoIt components into `c:\temp`, and launched a shellcode loader followed by a Delphi-based in-memory loader. The final payload was identified as DarkGate `6.1.9`, with extracted configuration including C2 domain `prodomainnameeforappru.com`, port `443`, campaign ID `admin888`, persistence enabled, and multiple anti-VM and environment checks; the delivery domain `selectwendormo9tres[.]com` had already been sinkholed at the time of analysis.
Aug 15, 2026
DarkGate has emerged as a versatile **malware-as-a-service** loader and remote access trojan used by multiple threat actors, including **TA577**, **Ducktail**, **UNC2975**, and **UNC5085**, with campaigns delivering it through large-scale email waves, fake browser updates, VBScript loaders, MSI installers, and messaging platforms such as **Skype** and **Microsoft Teams**. Proofpoint reported one major cluster, dubbed **BattleRoyal**, using DarkGate in attacks against organizations in the United States and Canada, relying on traffic distribution systems including **404 TDS** and **Keitaro TDS** and abusing malicious `.URL` files tied to **`CVE-2023-36025`** to bypass Windows SmartScreen protections before later shifting some activity to NetSupport. Technical analyses describe DarkGate as a mature platform with broad post-compromise capabilities, including reverse shell access, **PowerShell** execution, keylogging, credential and token theft, hidden **VNC** remote control, privilege escalation, persistence, file management, and even **XMRig**-based Monero mining. Researchers said the malware continues to evolve its evasion and execution methods through custom Base64 and XOR-obfuscated configuration data, HTTP POST command-and-control, alternate ports such as `2351` and `9999`, dynamic API resolution, parent PID spoofing, APC injection via **`NtTestAlert`**, DLL side-loading, AutoIt-based execution, and LOLBAS abuse through **`extexport.exe`**, underscoring DarkGate’s ongoing role as a significant cybercrime threat.
Aug 15, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026