Between July and September, cybercriminals used compromised Skype to distribute the DarkGate malwareby infecting users via emails containing attachments with a VBA loader script.
According to Trend Micro security researchers who discovered the attacks, this script downloads a second-stage AutoIT script that installs and executes the final DarkGate malware payload.
"Access to the victim's Skype account allowed the attacker to compromise an existing message thread and create corresponding file names torelate to the context of the chat history," Trend Micro said.
“It is unclear how the initial instant messaging accounts were compromised, but it is believed to have been either through leaked credentials available on underground forums or through a previous breach of the organization“.
See also: Signal: No evidence of zero-day vulnerability
Trend Micro had also observed DarkGate malware operators attempting to promote the malware via Microsoft Teams to organizations where the service was configured to accept messages from external users.
Phishing campaigns that used malicious VBScript to deploy the DarkGate malware via Teams were previously detected by Truesec and MalwareBytes.
The attackers targeted Microsoft Teams users via compromised Office 365 accounts outside their organizations and a publicly available tool called TeamsPhisher . This tool allows attackers to bypass restrictions on incoming files from external tenants and send phishing attachments to Teams users
“The goal is still to penetrate the entire environment, and depending on the threat group that purchased or leased the DarkGate variant used, the threats can vary from ransomware to cryptomining,” Trend Micro said.
According to researchers' data, there may be some connection between the DarkGate malware and the Black Basta.
DarkGate malware attacks
Cybercriminals are increasingly using the DarkGate malware loader for initial access to corporate networks, a trend seen after authorities took down the Qakbot botnet in August
See also: Partial encryption: The latest trend in ransomware
Before Qakbot was taken down, a person purporting to be the developer of DarkGate attempted to sell memberships to a hacking forum, citing an annual fee of up to $100,000.
According to the advertisement, the malware offers a wide range of features, including a hidden VNC , Windows Defender bypass capabilities , a browser history stealing tool, a Discord token stealer , and more.
After the malware was advertised on the hacking forum, an increase in attacks distributing DarkGate via various delivery methods, such as phishing and malvertising.
The importance of malware
Technology has become a dominant part of our daily lives. From our personal and professional communications to our banking, everything is now digital. This means an increased reliance on digital tools and therefore an increased risk of infection by malicious software, also known as malware.
Malware malicious software that often aims to deceive users, violate their personal privacy, destroy their systems, or steal financial information.
See also: Ransomware attacks target vulnerable WS_FTP servers
Security in the digital world
It is obvious that proper protection against malware, including DarkGate, is essential for the security of users and systems. Without proper protection, our digital assets, such as our personal data, financial information, and even our digital identities, are exposed.
Protection measures
You can protect yourself from malwareby following some basic security practices:
- Install the latest software updates
- Use antivirus software and update it regularly
- Avoid opening unknown links in emails or websites
- Use strong unique passwords and
- Back up your essential data
Source: www.bleepingcomputer.com
