Vietnamese Hackers Target U.K., U.S., and India with DarkGate Malware

Attacks leveraging the DarkGate commodity malware focusing on entities in the U.K., the U.S., and India have been linked to Vietnamese actors connected with the use of the notorious Ducktail stealer.

“The overlap of resources and strategies is incredibly probably owing to the consequences of a cybercrime marketplace,” WithSecure mentioned in a report released right now. “Danger actors are able to receive and use several various tools for the same reason, and all they have to do is appear up with targets, campaigns, and lures.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The advancement arrives amid an uptick in malware strategies employing DarkGate in latest months, primarily driven by its author’s determination to rent it out on a malware-as-a-company (MaaS) basis to other menace actors after employing it privately considering the fact that 2018.

It really is not just DarkGate and Ducktail, for the Vietnamese risk actor cluster liable for these strategies is leveraging similar or incredibly related lures, themes, targeting, and shipping techniques to also provide LOBSHOT and RedLine Stealer.

Attack chains distributing DarkGate are characterised by the use of AutoIt scripts retrieved via a Visible Fundamental Script despatched through phishing e-mail or messages on Skype or Microsoft Teams. The execution of the AutoIt script potential customers to the deployment of DarkGate.

In this scenario, having said that, the initial an infection vector was a LinkedIn message that redirected the target to a file hosted on Google Generate, a procedure normally utilised by Ducktail actors.

“Very very similar marketing campaign themes and lures have been utilised to produce Ducktail and DarkGate,” WithSecure mentioned, even though the function of the remaining-phase differs to terrific extent.

Whilst Ducktail capabilities as a stealer, DarkGate is a remote obtain trojan (RAT) with info-thieving abilities that also set up covert persistence on the compromised hosts for backdoor obtain.

“DarkGate has been all around for a prolonged time and is being utilised by lots of teams for diverse reasons, and not just this team or cluster in Vietnam,” security researcher Stephen Robinson, senior risk intelligence analyst at WithSecure, stated.

“The flipside of this is that actors can use several equipment for the identical campaign, which could obscure the legitimate extent of their activity from purely malware-primarily based examination.”

Discovered this report fascinating? Follow us on Twitter  and LinkedIn to go through far more unique written content we submit.