DarkGate

Description

DarkGate is a malware loader and remote access trojan that continues to evolve with new variants and loading approaches. Its operators rent it out as a loader, and it delivers payloads such as remote access trojans and information stealers onto infected systems, arriving through phishing, malicious documents, and abuse of messaging platforms. The loader checks its environment before deploying, and its frequent rewrites reflect an operation that invests in evading analysis.

Stats

First seen: August 2023
Last seen: October 2026

Also known as

DarkgateLNKDarkGate

MITRE ATT&CK techniques

58 techniques across 13 tactics.

TA0042 Resource Development

T1583Acquire Infrastructure
- T1583.001Domains

TA0001 Initial Access

T1566Phishing
- T1566.002Spearphishing Link
- T1566.001Spearphishing Attachment

TA0002 Execution

T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
- T1059.001PowerShell
- T1059.010AutoHotKey & AutoIT
- T1059.005Visual Basic
- T1059.003Windows Command Shell
T1106Native API
T1204User Execution
- T1204.002Malicious File
T1569System Services
- T1569.002Service Execution

TA0003 Persistence

T1098Account Manipulation
- T1098.007Additional Local or Domain Groups
T1136Create Account
- T1136.001Local Account
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.007Double File Extension
- T1036.003Rename Legitimate Utilities
T1036Masquerading
- T1036.007Double File Extension
- T1036.003Rename Legitimate Utilities
T1055Process Injection
- T1055.012Process Hollowing
T1070Indicator Removal
- T1070.004File Deletion
T1134Access Token Manipulation
- T1134.004Parent PID Spoofing
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
T1564Hide Artifacts
- T1564.001Hidden Files and Directories
T1574Hijack Execution Flow
- T1574.001DLL
- T1574.007Path Interception by PATH Environment Variable
T1622Debugger Evasion

TA0006 Credential Access

T1539Steal Web Session Cookie
T1552Unsecured Credentials
T1555Credentials from Password Stores

TA0007 Discovery

T1010Application Window Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1124System Time Discovery
T1518Software Discovery
- T1518.001Security Software Discovery
T1614System Location Discovery
T1680Local Storage Discovery

TA0009 Collection

T1005Data from Local System
T1056Input Capture
- T1056.001Keylogging
T1115Clipboard Data
T1119Automated Collection

TA0011 Command and Control

T1001Data Obfuscation
T1071Application Layer Protocol
- T1071.004DNS
T1105Ingress Tool Transfer
T1665Hide Infrastructure

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

TA0040 Impact

T1486Data Encrypted for Impact
T1490Inhibit System Recovery
T1496Resource Hijacking
- T1496.001Compute Hijacking
T1529System Shutdown/Reboot
T1561Disk Wipe
- T1561.001Disk Content Wipe
T1657Financial Theft

TA0112 Defense Impairment

T1685Disable or Modify Tools

Associated campaigns

C0037Water Curupira Pikabot Distribution

Alert name variants

Alert Name	Engine
Binary.Trojan.DarkGate	ATP Sandbox Adv. Heuristics
Document-HTML.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Document-HTML.Trojan.DarkGate	ATP Sandbox Adv. Heuristics
Document-Office.Downloader.Darkgate	ATP Sandbox Adv. Heuristics
Document-Office.Downloader.DarkGate	ATP Sandbox Adv. Heuristics
Document-Office.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Document-PDF.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Document-Word.Downloader.Darkgate	ATP Sandbox Adv. Heuristics
Email-MSG.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Script-AutoIt.Malware.DarkGate	ATP Sandbox Adv. Heuristics
Script-AutoIt.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Script-AutoIt.Trojan.DarkGate	ATP Sandbox Adv. Heuristics
Script-JS.Downloader.DarkGate	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.DarkGate	ATP Sandbox Adv. Heuristics
Script-PowerShell.Downloader.DarkGate	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.DarkGate	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.DarkGate	ATP Sandbox Adv. Heuristics
Script.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.DarkGate	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.LNKDarkGate	ATP Sandbox Adv. Heuristics
Win32.Backdoor.DarkGate	ATP Sandbox Adv. Heuristics
Win32.Ransomware.DarkGate	ATP Sandbox Adv. Heuristics
Win32.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Win32.Trojan.DarkGate	ATP Sandbox Adv. Heuristics
Win64.Downloader.Darkgate	ATP Sandbox Adv. Heuristics
Win64.Trojan.Darkgate	ATP Sandbox Adv. Heuristics
Win64.Trojan.DarkGate	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC UNC4962.Darkgate.c2 traffic detected	IPS-SWG
MALWARE-CNC UNC4962.Darkgate.C2.Communication traffic detected	IPS-SWG
MALWARE-CNC Win.Malware.DarkGate outbound connection attempt	IPS-SWG
MALWARE-CNC Win.Malware.DarkGate variant outbound connection	IPS-SWG
MALWARE-CNC Win.Trojan.DarkGate variant outbound connection attempt	IPS-SWG