Battling DarkGate Malware: Lessons from the Frontlines

New threats are emerging daily. One such threat that has been making headlines is DarkGate malware. First reported in 2018, DarkGate has been primarily delivered through email spam campaigns. However, a recent incident involving Malwarebytes' Managed Detection and Response (MDR) team has shed light on a new delivery mechanism—Microsoft Teams. Let's dive into this real-world example to understand the intricacies of this attack and how it was mitigated.

The Initial Attack Vector: Microsoft Teams

On September 13, 2023, the Malwarebytes MDR team detected a DarkGate malware campaign on a client's network. The initial point of entry? A phishing attempt via Microsoft Teams. The attackers sent a malicious ZIP file named "C_onfidential Sign_ificant Company Changes.zip" to several employees. The ZIP file contained malicious shortcut files disguised as PDF documents, which, when clicked, triggered a malicious command line.

The Malicious Command

The command line's purpose was to download and run a harmful script from a remote IP address. Fortunately, Malwarebytes' Endpoint Detection and Response (EDR) recognized the IP as a 'known bad' destination and blocked it. The MDR team found that the attack was part of a larger campaign that used Teams phishing to install DarkGate Loader.

Swift Response and Mitigation

Recognizing the gravity of the situation, the MDR team isolated the affected machines and took extra precautions to ensure no persistence mechanisms were present on the endpoints. They also suggested blocking the download of files from external accounts in Microsoft Teams, which was the primary attack vector in this campaign.

Lessons Learned

The threat actors behind these campaigns use a combination of evasion techniques to distribute DarkGate with a minimal system footprint. If the infection had continued, the company could have faced potential data breaches, operational disruptions, financial losses, and more.

Indicators of Compromise (IoC)

The Indicators of Compromise (IoC) for the recent DarkGate malware incident provide critical insights into the attack's anatomy. The initial point of compromise was a malicious ZIP file named "C_onfidential Sign_ificant Company Changes.zip," sent via Microsoft Teams. This file contained deceptive shortcut files with extensions like .PDF.LNK, designed to trigger malicious command line executions. The Command & Control (C2) IP address associated with the attack was 5[.]188[.]87[.]58, and it was used to fetch malicious scripts, including an AutoIt script named btbgvbyy.au3. These indicators serve as a roadmap for understanding the attack vectors, malicious files, and network activities involved in this DarkGate campaign. Organizations are advised to use this IoC list as a foundation for enhancing their cybersecurity measures.

File Details:

Filename: C_onfidential Sign_ificant Company Changes.zip

Network Indicators:

C2 IP Address: 5[.]188[.]87[.]58

Malicious URLs:

http://5[.]188[.]87[.]58:2351

http://5[.]188[.]87[.]58:2351/msibtbgvbyy

Conclusion

The DarkGate malware incident serves as both a cautionary tale and a learning opportunity for organizations. By dissecting the attack, from its initial vector via Microsoft Teams to the malicious commands and files involved, we gain invaluable insights into the tactics, techniques, and procedures (TTPs) employed by threat actors. The Indicators of Compromise (IoC) serve as a critical roadmap for understanding and mitigating such sophisticated attacks. These IoCs should not just be a checklist but an integral part of an organization's cybersecurity strategy. By staying vigilant and continually updating our understanding of emerging threats, we can not only defend against current attacks but also anticipate future vulnerabilities. This proactive approach to cybersecurity is essential in today's rapidly evolving threat landscape.

Sources:

• DarkGate is a Windows-based malware
• Researchers at Trusec found evidence