Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Dark Gate: Dancing the Samba With Alluring Excel Files

Summary: Unit 42 documented a DarkGate malware campaign from March to April 2024 in which Microsoft Excel (.xlsx) files with a linked Open button pulled a VBS or JS file from publicly accessible Samba/SMB shares, which then ran a PowerShell script that downloaded and launched an AutoHotKey-based DarkGate package. Activity peaked on April 9, 2024, with almost 2,000 samples in a single day, and the campaign initially targeted North America before spreading to Europe and parts of Asia.

Bottom line: DarkGate's PowerShell scripts checked for a Kaspersky Lab directory and, if found, pulled the legitimate AutoHotKey.exe to avoid tripping that antivirus, while the final payload also scanned for Windows Defender and SentinelOne - so the malware is written specifically around the security tools it expects to meet.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related