We’re about to witness a significant surge in the deployment of DarkGate and NetSupport, security experts are warning.
Researchers from Proofpoint claim to have observed a brand new threat actor, dubbed “BattleRoyal”. This threat actor mounted at least 20 email campaigns in the months between September and November this year, to deliver the DarkGate malware.
In late November and early December, the group pivoted from DarkGate to NetSupport, a legitimate remote access tool frequently abused by hackers to establish persistence on targeted endpoints. Besides emails, the group also used a series of compromised websites and fake update lures to get people to download the malware.
Abusing a SmartScreen flaw
The reasons for the switch remain a mystery, with the researchers hinting it might be due to DarkGate drawing too much attention.
In any case, the group was abusing a vulnerability tracked as CVE-2023-36025 to deliver the malware. Other groups abused this flaw too, but the BattleRoyal cluster “exploited this vulnerability more than any other actor observed in Proofpoint threat data.” BattleRoyal was abusing it even before it was published by Microsoft, the company said.
The flaw is found in Windows SmartScreen, a security feature designed to stop people from visiting dangerous websites. Proofpoint explained that the attackers could bypass SmartScreen defenses by getting the victim to click on a specially designed URL, which the vulnerability allowed.
As explained by Malpedia, DarkGate is a commodity loader first documented in 2018. It comes with numerous features, including the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, the ability to log keystrokes, steal sensitive information, and escalate privileges. DarkGate abuses legitimate AutoIt files and typically runs multiple AutoIt scripts.
New versions of DarkGate have been advertised on a Russian-language eCrime forum since May 2023, the report concludes.
