DarkGate Malware: Threat Exploiting AutoHotkey - Cyber and Fraud Centre

The DarkGate malware family, a persistent threat since 2018, has recently resurfaced in a sophisticated global campaign. This Remote Access Trojan (RAT), built using the Borland Delphi programming language, is designed to steal sensitive information and provide attackers with remote control and access over infected systems.

Understanding the Attack

The current DarkGate campaign employs a deceptive phishing tactic. Victims receive HTML files disguised as legitimate documents, often Microsoft Word files. Upon opening the HTML file, users are prompted to use a mode like ‘Cloud View’ to access the content. This interaction triggers a series of actions:

Redirection: The victim is redirected to Windows Explorer, creating the illusion of accessing a legitimate cloud storage service such as OneDrive.
Exploitation: A malicious Internet Shortcut (.url) file exploits vulnerabilities in Microsoft Defender SmartScreen, allowing the execution of harmful scripts.
Payload Delivery: A VBScript file initiates the download and execution of additional Darkgate components, including the AutoHotkey utility.
Command and Control: The malware establishes communication with attacker-controlled servers.

DarkGate’s Capabilities

Once DarkGate has successfully infected a system, it has the potential to:

Steal Sensitive Data: Exfiltrate login credentials, financial information, and intellectual property.
Execute Malicious Commands: Remotely control the infected system.
Log Keystrokes: Record everything a user types, capturing passwords and other private data.
Install Additional Malware: Download and deploy further payloads.

Protecting Yourself and Your Organisation

To reduce the risk of falling victim to a DarkGate attack, follow these essential cyber security practices:

Be Suspicious of Unexpected Files: Exercise caution before opening attachments or clicking links, even if they appear to come from a familiar source.
Verify Sender Information: Double-check the sender’s email address for inconsistencies or suspicious domains.
Think Before You Click: Avoid clicking on links or buttons unless you understand their purpose and trust the source.
Use Up-to-Date Security Software: Keep your operating system, antivirus software, and web browser updated with the latest security patches.
Employee Training: Educate your employees about common phishing techniques to empower them to identify potential threats.

Staying Vigilant

The DarkGate malware family poses a substantial threat to individuals and businesses globally. By following these guidelines and staying up-to-date on emerging cyber threats, you can significantly reduce your risk of compromise.

A comprehensive breakdown of the attack can be found at: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/the-darkgate-menace-leveraging-autohotkey-attempt-to-evade-smartscreen/

Further information available at:

https://candid.technology/darkgate-spreads-to-30-countries-via-novel-html-phishing

02.05.24

Threat Intelligence Alerts