Loading story…
Researchers tied TrickGate, a shellcode-based packer and loader active since 2016, to the delivery of a wide range of malware families including TrickBot, Emotet, REvil, Maze, Cerber, Formbook, AgentTesla, AZORult, and Cobalt Strike. Check Point said the service has persisted through frequent wrapper changes and aliases while retaining the same core shellcode components, supporting the assessment that it is a single maintained operation used by multiple threat actors. Observed activity ranged from dozens to hundreds of attacks per week, typically beginning with phishing emails carrying archives, documents, or executables that launch a shellcode loader and inject the final payload while avoiding antivirus and EDR detection.
Separate reporting from Cisco Talos described a related class of email-delivered loaders used to distribute HawkEye Reborn, Remcos, and cryptocurrency miners through malicious Office files exploiting CVE-2017-11882. The loader decrypted payloads only at runtime, hid them in PE resources, and used process hollowing into RegAsm.exe, API hashing, callback abuse, direct syscalls, and the Heaven’s Gate technique to evade monitoring under WOW64. Both reports show how long-lived loader services and packers have become shared infrastructure for cybercrime, enabling repeated delivery of stealers, RATs, and ransomware through stealthy in-memory execution and anti-analysis tradecraft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Check Point said the TrickGate operational pause ended on September 26, 2022. Activity resumed after more than three months of inactivity.
Check Point observed a more than three-month operational pause in TrickGate activity from June 13, 2022 to September 26, 2022. The interruption stood out in an otherwise long-running malware-packing service.
Check Point reported that TrickGate used CRC32 for API hashing until January 2021, after which it switched to custom hash functions. This marked a technical evolution in how the packer concealed Windows API usage.
Check Point found that TrickGate shellcodes from 2016 through 2020 showed about 90% similarity. The analysis indicated the core shellcode was continuously maintained while preserving the same building blocks.
Check Point said the TrickGate shellcode-based packer-as-a-service was initially observed in July 2016. The report identifies this as the start of a long-running operation used to conceal malware from security tools.
Check Point reported that it first observed TrickGate at the end of 2016 delivering Cerber ransomware. This tied the packer to one of the early malware families it was used to deploy.
In its 2023 report, Check Point assessed with high confidence that malware packers tracked under names including TrickGate, Emotet's packer, new loader, Loncom, and NSIS-based crypter were the same maintained service. The conclusion was supported by long-term code-similarity analysis and shared shellcode building blocks.
Cisco Talos reported an ongoing phishing-driven malware distribution campaign using a sophisticated Windows loader to deliver HawkEye Reborn, Remcos, and cryptocurrency miners. The loader used runtime decryption, process hollowing into RegAsm.exe, API hashing, CallWindowProcW abuse, and Heaven's Gate to evade detection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 351 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied multiple malware components to **TrickBot-associated operations**, including a custom loader that fetched encoded payloads from GitHub files disguised as images and launched a 64-bit **Cobalt Strike** beacon directly in memory. The loader manually resolved APIs from `ntdll.dll` and `kernel32.dll`, loaded `wininet.dll`, and used HTTPS command-and-control on port `443`, with beacon configuration pointing to `rainbowmango.info` subdomains and `gpupdate.exe` configured as a spawn-to process. Separate analysis of **TrickLoader**, the TrickBot framework’s loader component, showed years of increasing obfuscation, including hidden resource names, custom Base64 schemes, compressed payloads, function-table reconstruction, and anti-analysis techniques such as UAC bypass and Heaven’s Gate. Additional reporting linked a newer **Krypton/Xenon crypter** and related data-exfiltration malware to the same ecosystem through a distinctive string-encoding pattern ending in `mOrxx` that had previously appeared in TrickBot tooling. Unpacked samples contained references to **Mimikatz**, a proof-of-concept for `CVE-2020-0787`, and downloads from `raw.githubusercontent.com`, while the exfiltration malware used WinINet APIs to upload stolen data to hard-coded `uploadFile.php` endpoints and also enumerated processes and collected desktop and window information. Investigators identified infrastructure including `temp.positiveseca.com`, `se1.buttonrich.com`, `figures.pablotech.info`, and `files.pablotech.info`, reinforcing links between TrickBot loaders, post-exploitation tooling, and data-theft activity.
Aug 14, 2026
TrickBot emerged as a banking trojan linked to post-Dyre criminal activity and was initially distributed through spam campaigns that installed intermediary loaders before fetching the malware from command-and-control infrastructure. Over time, operators expanded delivery methods to include malicious links, macro-enabled Word documents, ZIP archives with shortcut files, and phishing chains involving loaders such as Smoke Loader and Godzilla Loader. Researchers documented TrickBot copying itself into `%AppData%\Roaming`, using download-and-execute tasking, stealing browser passwords, form data, banking information, and system details, and in at least one case deploying an **XMRig** Monero miner alongside its core modules. Network and intrusion analysis showed TrickBot using distinctive HTTPS/TLS command-and-control traffic on ports `443`, `447`, and `449`, HTTP exfiltration on port `8082`, and disguised payload retrieval through `.png` URLs that actually served Windows executables. The malware was also observed moving laterally in Active Directory environments via an EternalBlue-based SMB exploit and frequently serving as an initial access platform for **Cobalt Strike** and ransomware including **Ryuk** and **Conti**. By 2021 and early 2022, researchers reported a shift in the ecosystem as TrickBot was used to deliver **Emotet** and **Qbot**, while fresh TrickBot campaigns declined, suggesting operators were monetizing remaining infections and transitioning toward newer malware platforms.
Aug 15, 2026
DarkGate has emerged as a versatile **malware-as-a-service** loader and remote access trojan used by multiple threat actors, including **TA577**, **Ducktail**, **UNC2975**, and **UNC5085**, with campaigns delivering it through large-scale email waves, fake browser updates, VBScript loaders, MSI installers, and messaging platforms such as **Skype** and **Microsoft Teams**. Proofpoint reported one major cluster, dubbed **BattleRoyal**, using DarkGate in attacks against organizations in the United States and Canada, relying on traffic distribution systems including **404 TDS** and **Keitaro TDS** and abusing malicious `.URL` files tied to **`CVE-2023-36025`** to bypass Windows SmartScreen protections before later shifting some activity to NetSupport. Technical analyses describe DarkGate as a mature platform with broad post-compromise capabilities, including reverse shell access, **PowerShell** execution, keylogging, credential and token theft, hidden **VNC** remote control, privilege escalation, persistence, file management, and even **XMRig**-based Monero mining. Researchers said the malware continues to evolve its evasion and execution methods through custom Base64 and XOR-obfuscated configuration data, HTTP POST command-and-control, alternate ports such as `2351` and `9999`, dynamic API resolution, parent PID spoofing, APC injection via **`NtTestAlert`**, DLL side-loading, AutoIt-based execution, and LOLBAS abuse through **`extexport.exe`**, underscoring DarkGate’s ongoing role as a significant cybercrime threat.
Aug 15, 2026