Dark Gate switches up its tactics with new payload, email templates
Summary: Cisco Talos traced a DarkGate malspam campaign that delivered Excel attachments using Remote Template Injection to pull a VBS file from an attacker-controlled SMB share, then a PowerShell script from the DarkGate command-and-control server. On March 12, 2024, the campaign switched from AutoIT to AutoHotKey scripts, using a legitimate AutoHotKey.exe binary to decode a base64 blob from test.txt and run the DarkGate payload in memory without saving it to disk.
Key Takeaway: The campaign targeted the U.S. most often, with healthcare technologies and telecommunications as the most-targeted sectors, and established persistence through a shortcut placed in the Windows Startup directory.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026