Loading story…
Researchers published new technical findings on DarkGate, showing that defenders can recover key operational data from recent versions of the Windows malware. Kroll reported that DarkGate 5.2.3 uses a flawed method to randomize its custom Base64 alphabet: the shuffle seed is derived from the sum of bytes in a 32-byte hardware ID, reducing the search space to just 1,248 possible alphabets. That weakness allows analysts to brute-force and decode on-disk configuration files and keylogger output without first obtaining the victim-specific hardware ID, exposing details such as domains, ports, versioning, campaign settings, and captured user input. Separate analysis from DCSO CyTec showed that newer DarkGate keylogger logs can also be decrypted by reconstructing the malware’s bot ID from host attributes and the internal_mutex value, then deriving the AES/Rijndael key despite DarkGate’s custom Delphi cryptographic implementation.
A separate campaign analysis traced how DarkGate was delivered through a malicious PDF lure that led victims to download build-x64.msi, an installer signed with a valid certificate. The MSI executed a custom action DLL and abused DLL sideloading via a legitimate iTunesHelper.exe binary to load a malicious CoreFoundation.dll, which decrypted data from sqlite3.dll using the XOR key VzXLKSZE, extracted AutoIt components into c:\temp, and launched a shellcode loader followed by a Delphi-based in-memory loader. The final payload was identified as DarkGate 6.1.9, with extracted configuration including C2 domain prodomainnameeforappru.com, port 443, campaign ID admin888, persistence enabled, and multiple anti-VM and environment checks; the delivery domain selectwendormo9tres[.]com had already been sinkholed at the time of analysis.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Kroll analyzed DarkGate version 5.2.3 and found that its shuffled custom base64 alphabet is seeded from the sum of bytes in a 32-byte hardware ID, reducing the search space to 1,248 possible alphabets. Kroll showed this makes it practical to brute force and decode stored configuration files and keylogger output without first recovering the victim-specific hardware ID.
Analysis of the Q1 2024 campaign determined that the final in-memory payload was DarkGate version 6.1.9. Extracted configuration included the C2 domain prodomainnameeforappru.com on port 443 and showed persistence and environment-checking behavior.
Avast Threat Labs observed a DarkGate campaign in the first quarter of 2024 that used malicious PDF lures to redirect victims to selectwendormo9tres[.]com and download build-x64.msi. Executing the MSI led to infection through a multi-stage chain involving a signed installer, DLL sideloading via Apple iTunesHelper.exe, AutoIt components, and in-memory loaders.
DCSO CyTec published an analysis of newer DarkGate versions that derive keylog encryption keys from a victim-specific bot ID and the internal_mutex value, rather than using a fixed key. The researchers also released tooling in Windows, Python, and Delphi to recover the bot ID, derive the key, and decrypt DarkGate keylog files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
3 references tracked. Mallory keeps watching after this page renders.
kienmanowar.wordpress.com
Open sourcekroll.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed multiple **DarkGate** infection chains that began with phishing lures themed as invoices or DocuSign documents and pushed victims toward malicious `CAB` and `MSI` installers. In one case, a wrapped DoubleClick ad URL delivered an `MSI` signed with a valid certificate issued to **“Inoellact EloubantTech Optimization Information Co., Ltd.”**, helping the malware evade reputation checks. The installer unpacked a cabinet containing legitimate signed binaries alongside tampered DLLs, enabling **DLL sideloading** and staged decryption before launching the next payload. Analysis showed DarkGate using a layered loader architecture built around Delphi components and **AutoIt** scripts to reconstruct shellcode in memory and execute the final malware. One chain used a legitimate Apple binary with a modified `CoreFoundation.dll` and an encrypted `sqlite3.dll`; another abused `windbg.exe` in a similar sideloading flow. The recovered payload was the **DarkGate** agent, a malware-as-a-service loader capable of remote access and follow-on malware delivery, and one sample communicated with `prodomainnameeforappru[.]com` (`46.21.157.142`) over port `443`.
Aug 15, 2026
DarkGate has emerged as a versatile **malware-as-a-service** loader and remote access trojan used by multiple threat actors, including **TA577**, **Ducktail**, **UNC2975**, and **UNC5085**, with campaigns delivering it through large-scale email waves, fake browser updates, VBScript loaders, MSI installers, and messaging platforms such as **Skype** and **Microsoft Teams**. Proofpoint reported one major cluster, dubbed **BattleRoyal**, using DarkGate in attacks against organizations in the United States and Canada, relying on traffic distribution systems including **404 TDS** and **Keitaro TDS** and abusing malicious `.URL` files tied to **`CVE-2023-36025`** to bypass Windows SmartScreen protections before later shifting some activity to NetSupport. Technical analyses describe DarkGate as a mature platform with broad post-compromise capabilities, including reverse shell access, **PowerShell** execution, keylogging, credential and token theft, hidden **VNC** remote control, privilege escalation, persistence, file management, and even **XMRig**-based Monero mining. Researchers said the malware continues to evolve its evasion and execution methods through custom Base64 and XOR-obfuscated configuration data, HTTP POST command-and-control, alternate ports such as `2351` and `9999`, dynamic API resolution, parent PID spoofing, APC injection via **`NtTestAlert`**, DLL side-loading, AutoIt-based execution, and LOLBAS abuse through **`extexport.exe`**, underscoring DarkGate’s ongoing role as a significant cybercrime threat.
Aug 15, 2026
Attackers used compromised Microsoft 365 accounts to deliver **DarkGate Loader** through Microsoft Teams external chat, shifting away from traditional email-based malware delivery. In the observed campaign, HR-themed messages lured recipients into opening a SharePoint-hosted ZIP archive named `Changes to the vacation schedule.zip`, which contained a malicious `.lnk` file. That shortcut launched a VBScript downloader that fetched additional components, including a renamed `cURL` binary, `AutoIt3.exe`, and an AutoIT script that ultimately deployed DarkGate in memory. Analysis showed the AutoIT stage checked for Sophos antivirus before deobfuscating shellcode and reconstructing the final Windows payload, while Microsoft Defender identified the ZIP-delivered malware as `BAT/Tisifi.A#` and VirusTotal linked the final payload to DarkGateLoader. The campaign also highlighted a defensive gap: Microsoft Teams protections such as Safe Attachments and Safe Links did not stop the attack path, underscoring the need for administrators to tighten Teams external chat settings and restrict communication to trusted organizations and domains.
Aug 15, 2026