DarkGate Malware Exploits Samba File Shares in Short-Lived Campaign

Cybersecurity scientists have shed light on a small-lived DarkGate malware campaign that leveraged Samba file shares to initiate the bacterial infections.

Palo Alto Networks Unit 42 claimed the action spanned the months of March and April 2024, with the an infection chains utilizing servers working public-experiencing Samba file shares hosting Visible Primary Script (VBS) and JavaScript data files. Targets incorporated North America, Europe, and areas of Asia.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“This was a rather quick-lived marketing campaign that illustrates how risk actors can creatively abuse genuine instruments and products and services to distribute their malware,” security researchers Vishwa Thothathri, Yijie Sui, Anmol Maurya, Uday Pratap Singh, and Brad Duncan explained.

DarkGate, which very first emerged in 2018, has advanced into a malware-as-a-services (MaaS) giving utilised by a tightly controlled selection of prospects. It arrives with abilities to remotely handle compromised hosts, execute code, mine cryptocurrency, start reverse shells, and fall added payloads.

Attacks involving the malware have particularly witnessed a surge in current months in the aftermath of the multinational law enforcement takedown of the QakBot infrastructure in August 2023.

The campaign documented by Device 42 commences with Microsoft Excel (.xlsx) data files that, when opened, urge targets to click on an embedded Open up button, which, in convert, fetches and operates VBS code hosted on a Samba file share.

The PowerShell script is configured to retrieve and execute a PowerShell script, which is then utilised to down load an AutoHotKey-dependent DarkGate package deal.

Alternate sequences using JavaScript documents as a substitute of VBS are no distinctive in that they are also engineered to obtain and run the follow-up PowerShell script.

DarkGate performs by scanning for different anti-malware plans and examining the CPU details to identify if it really is working on a actual physical host or a virtual natural environment, therefore letting it to hinder examination. It also examines the host’s functioning procedures to establish the existence of reverse engineering applications, debuggers, or virtualization software.

“DarkGate C2 visitors employs unencrypted HTTP requests, but the info is obfuscated and seems as Base64-encoded text,” the researchers stated.

“As DarkGate continues to evolve and refine its strategies of infiltration and resistance to evaluation, it stays a powerful reminder of the need for sturdy and proactive cybersecurity defenses.”

Found this write-up intriguing? Adhere to us on Twitter  and LinkedIn to browse more distinctive content material we put up.