This growing malware threat actor is set to unleash a surge of attacks, experts warn

Hacker
Image Credit: Geralt / Pixabay (Image credit: Image Credit: Geralt / Pixabay)

We’re about to witness a significant surge in the deployment of DarkGate and NetSupport, security experts are warning.

Researchers from Proofpoint claim to have observed a brand new threat actor, dubbed "BattleRoyal". This threat actor mounted at least 20 email campaigns in the months between September and November this year, to deliver the DarkGate malware

In late November and early December, the group pivoted from DarkGate to NetSupport, a legitimate remote access tool frequently abused by hackers to establish persistence on targeted endpoints. Besides emails, the group also used a series of compromised websites and fake update lures to get people to download the malware. 

Abusing a SmartScreen flaw

The reasons for the switch remain a mystery, with the researchers hinting it might be due to DarkGate drawing too much attention. 

In any case, the group was abusing a vulnerability tracked as CVE-2023-36025 to deliver the malware. Other groups abused this flaw too, but the BattleRoyal cluster “exploited this vulnerability more than any other actor observed in Proofpoint threat data.” BattleRoyal was abusing it even before it was published by Microsoft, the company said.

The flaw is found in Windows SmartScreen, a security feature designed to stop people from visiting dangerous websites. Proofpoint explained that the attackers could bypass SmartScreen defenses by getting the victim to click on a specially designed URL, which the vulnerability allowed.

As explained by Malpedia, DarkGate is a commodity loader first documented in 2018. It comes with numerous features, including the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, the ability to log keystrokes, steal sensitive information, and escalate privileges. DarkGate abuses legitimate AutoIt files and typically runs multiple AutoIt scripts. 

New versions of DarkGate have been advertised on a Russian-language eCrime forum since May 2023, the report concludes.

More from TechRadar Pro

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Magnifying glass enlarging the word 'malware' in computer machine code
Microsoft Teams and AnyDesk abused to deploy dangerous malware, so be on your guard
A red padlock image against a digital map of the earth in blue.
Midnight Blizzard hacking group hijacks RDP proxies to launch malware attacks
A digital representation of a lock
Security experts are being targeted with fake malware discoveries
A computer being guarded by cybersecurity.
Huge cyberattack found hitting vulnerable Microsoft-signed legacy drivers to get past security
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Cisco, ASUS, QNAP, and Synology devices hijacked to major botnet
Illustration of a laptop with a magnifying glass exposing a beetle on-screen
Microsoft Outlook targeted by new malware attacks allowing sneaky hijacking
Latest in Security
Data Breach
Thousands of healthcare records exposed online, including private patient information
China
Juniper patches security flaws which could have let hackers take over your router
Representational image depecting cybersecurity protection
GitLab has patched a host of worrying security issues
Ai tech, businessman show virtual graphic Global Internet connect Chatgpt Chat with AI, Artificial Intelligence.
AI agents can be hijacked to write and send phishing attacks
China
Volt Typhoon threat group had access to American utility networks for the best part of a year
Abstract image of cyber security in action.
MassJacker malware targets those looking for pirated software
Latest in News
Google Pixel 8a in aloe green showing
Google Pixel 9a benchmark link teases the performance of the upcoming mid-ranger
Quordle on a smartphone held in a hand
Quordle hints and answers for Monday, March 17 (game #1148)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Monday, March 17 (game #379)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Monday, March 17 (game #645)
Apple iPhone 16 Pro HANDS ON
Leaked iPhone 17 dummy units may have given us our best look yet at all four models
A super close up image of the Google Gemini app in the Play Store
It's official: Google Assistant will be retired for phones this year, with Gemini taking over