DarkGate turned collaboration platforms into a malware delivery channel, sending links to external users through Microsoft Teams and relying on trust in internal-looking chat. This guide profiles DarkGate for defenders: its 2018 origins as a cryptomining and ransomware campaign, its rebirth as a rented malware-as-a-service loader and remote access tool, how it was delivered through email, Teams and SharePoint-hosted archives, what MITRE ATT&CK records about its 58 techniques, and the behaviour-level detections and Teams and endpoint controls that stop it. It is aimed at SOC analysts, detection engineers and Microsoft 365 administrators. The Malware Loaders and Droppers Guide covers loaders in general; this page stays with DarkGate.
Key takeaways
- A loader, a stealer and a RAT in one rented package. MITRE ATT&CK describes DarkGate (S1111) as an initial access and data gathering tool, first seen in 2018, linked to credential theft, cryptomining, cryptotheft and pre-ransomware activity, and offered by its author as malware-as-a-service.
- The subscription model drove its spread. Trellix reported the developer, known as RastaFarEye, sold access on underground forums for up to 15,000 US dollars per month, with buyers growing from about 10 to 30.
- Teams is a delivery channel, not just a chat tool. Trellix documented Teams messages linking to a SharePoint-hosted ZIP of shortcut files with a double extension and a PDF icon, so external access settings are a real control.
- AutoIt and DLL side-loading are the tell. DarkGate chains use VBS, MSI or LNK first stages that launch an AutoIt interpreter (T1059.010), and later versions side-load a trojanised DLL (T1574.001), which gives defenders stable behaviour to hunt.
- Response must assume stolen sessions and a new local admin. ATT&CK lists session cookie theft (T1539), local account creation (T1136.001) and adding accounts to groups (T1098.007), so recovery is an identity task as well as an endpoint one.
Who they are (names and aliases)
DarkGate is a commercial criminal product. The author builds and sells it; separate customers run campaigns. ATT&CK records only one name, but security vendors have used others for particular versions.
| Name or entity | Type | What the sources say |
|---|---|---|
| DarkGate | Malware family (ATT&CK S1111) | Written in Delphi, named DarkGate by its author, first emerged in 2018, use rose sharply from 2022 (ATT&CK). |
| MehCrypter | Earlier vendor name | Trellix notes Avast named a 2021 version MehCrypter. |
| RastaFarEye | Developer handle | Trellix reports the developer sells DarkGate on underground cybercrime forums. |
| Water Curupira Pikabot Distribution (C0037) | Campaign | ATT&CK links DarkGate to this 2023 campaign, run by an entity tied to Black Basta deployment after the QakBot takedown. |
Targeting and motivation
DarkGate is financially motivated, and because it is rented, targeting depends on the customer. The original 2018 campaign analysed by enSilo, republished by Fortinet, focused mainly on Spain and France and spread through torrent files posing as films and TV series and through spoofed emails. Later campaigns reported by Trellix targeted organisations through phishing and Teams.
- Monetisation routes: ATT&CK lists T1496.001 Compute Hijacking (cryptomining), T1657 Financial Theft, T1486 Data Encrypted for Impact and T1490 Inhibit System Recovery. The 2018 analysis described mining, wallet credential theft, ransomware and deletion of restore points.
- Access resale: its role as an initial access and pre-ransomware tool links it to the same buyers who used QakBot. See the QakBot Malware Guide.
- Development tempo: Trellix tracked version 4 in June 2023 and version 5 announced for October 2023, with new builds every few weeks, including updates after researchers published analysis and decryption tools for version 4.
Tactics and techniques (MITRE ATT&CK)
ATT&CK v20 maps 58 techniques to DarkGate. The table groups those that matter for detection and hardening.
| Stage | ATT&CK techniques | What defenders see |
|---|---|---|
| Initial access | T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1204.002 Malicious File | Email links to VBS or MSI files; Teams messages from external tenants linking to SharePoint-hosted archives (Trellix). |
| Masquerading | T1036.007 Double File Extension, T1036.003 Rename Legitimate Utilities, T1036 Masquerading | Files named like "report.pdf.lnk" with a PDF icon; renamed copies of legitimate interpreters. |
| Execution | T1059.010 AutoHotKey & AutoIT, T1059.005 Visual Basic, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1569.002 Service Execution | An AutoIt interpreter running a script from a user or ProgramData folder, often spawned by cmd.exe or msiexec. |
| Hijack execution flow | T1574.001 DLL, T1574.007 Path Interception by PATH Environment Variable | A legitimate signed application loading an unexpected DLL from its own folder. |
| Privilege and persistence | T1548.002 Bypass User Account Control, T1547.001 Registry Run Keys / Startup Folder, T1136.001 Local Account, T1098.007 Additional Local or Domain Groups | New local accounts added to Administrators; Run keys pointing at AutoIt scripts. |
| Stealth and defence impairment | T1055.012 Process Hollowing, T1134.004 Parent PID Spoofing, T1497.001 System Checks, T1622 Debugger Evasion, T1518.001 Security Software Discovery, T1685 Disable or Modify Tools | Hollowed system processes with misleading parents; behaviour that changes when particular antivirus products are present. |
| Credential access and collection | T1539 Steal Web Session Cookie, T1555 Credentials from Password Stores, T1552 Unsecured Credentials, T1056.001 Keylogging, T1115 Clipboard Data | Access to browser profiles and password stores by non-browser processes. |
| Command and control | T1071.004 DNS, T1105 Ingress Tool Transfer, T1001 Data Obfuscation, T1665 Hide Infrastructure, T1583.001 Domains | Connections from AutoIt or hollowed processes to recently registered domains or bare IPs on unusual ports. |
| Impact | T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery, T1561.001 Disk Content Wipe, T1496.001 Compute Hijacking | Shadow copy deletion, high sustained CPU use, or encryption on hosts where operators stayed. |
How they abuse identities and credentials
- Trust in collaboration identities: the Teams lure works because a chat from an external tenant can look like a colleague or a help desk. Microsoft Teams shows an External label, but users skim. See the Microsoft Teams Security Guide.
- Browser sessions: session cookie theft (T1539) gives the operator signed-in access to SaaS applications, sidestepping MFA prompts until the session is revoked. See the Infostealer Logs and Session Token Abuse Guide.
- Stored passwords: Trellix reports version 5 recovered RDP passwords using NetPass, and earlier versions took browser and Discord data.
- Backdoor accounts: the 2018 analysis described RDP installation and a hidden administrator account; ATT&CK lists local account creation and group changes. Alert on Security Event ID 4720 (account created) and 4732 (member added to a security-enabled local group) on workstations.
- Remote control: Trellix lists hidden VNC (hVNC), which lets an operator act in a hidden desktop as the logged-on user, so actions appear to come from a real identity.
Notable incidents
| Date | Event | Source and key facts |
|---|---|---|
| November 2018 | First public analysis | enSilo, republished by Fortinet: mining, wallet theft, ransomware, recovery tool interference, distribution through torrents mainly in Spain and France. |
| 2021 | MehCrypter version | Trellix: Avast renamed a 2021 version. |
| June to October 2023 | Versions 4 and 5 | Trellix: version 4 in June 2023; version 5 announced 29 September and builds seen from 10 October, adding DLL side-loading of a trojanised KeyScrambler DLL. |
| September 2023 | Attack stopped by a SOC | Trellix reports its SOC stopped a DarkGate attack against Musarubra. |
| 2023 | Pikabot distribution campaign | ATT&CK C0037 associates DarkGate with the Water Curupira campaign that followed the QakBot takedown. |
DarkGate shows why takedowns of one loader shift volume to others: when QakBot infrastructure was disrupted in August 2023, buyers moved to alternatives. See the Malware-as-a-Service Economy Guide.
Detection and defence
Behaviour-level detection ideas
- AutoIt from user paths: any AutoIt3.exe or renamed AutoIt interpreter started from AppData, Temp, Downloads or ProgramData, particularly by cmd.exe, msiexec.exe or a shortcut. Most organisations never run AutoIt legitimately, which makes this a high-signal rule.
- Double-extension shortcuts: process creation where the parent command line references a .pdf.lnk or similar file opened from a Teams or SharePoint download path.
- DLL side-loading: a signed application loading an unsigned DLL from the same writable folder it was dropped into (Sysmon Event ID 7).
- Command shells with public IPs: Trellix recommends EDR rules for command shells containing public IP addresses, and blocking suspicious curl connections at the web gateway.
- Account changes on endpoints: Event IDs 4720 and 4732 on non-server Windows hosts.
- External Teams chats with file links: where Microsoft 365 audit logs are available, correlate a first-contact external chat with a file download and a new process within minutes.
Teams and endpoint controls
| Option | When to choose it | Trade-off |
|---|---|---|
| Block all external Teams access | Organisations that do not collaborate over Teams with other tenants | Partners must use email or guest accounts instead. |
| Allow-list external domains (Trellix recommendation) | Most organisations: named partners keep working | Needs an owner to maintain the list. |
| Open federation with user warnings | Only where external chat with unknown tenants is a business need | Relies on users reading the External label; pair with strong endpoint controls. |
| Web gateway allows only the company's own SharePoint (Trellix) | Where the gateway can inspect cloud storage URLs | Breaks legitimate partner file sharing unless partners are allow-listed. |
| Application control blocking AutoIt and script hosts for standard users | Almost always | A few administrators may need exceptions. |
Framework mapping
| Defence | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Malware protection and sandboxing of collaboration files | SI-3 | DE.CM-09 |
| Application control for interpreters | CM-7 | PR.PS-05 |
| Boundary protection for external chat and storage | SC-7 | DE.CM-01 |
| Monitoring of account and group changes | SI-4, AC-2 | DE.CM-01 |
| User awareness of external chat lures | AT-2 | PR.AT-01 |
Rollout and response
- Inventory legitimate AutoIt use, then deploy the AutoIt-from-user-path rule in alert mode for two weeks.
- Restrict Teams external access to allowed domains, starting with a pilot group, and publish how users can request a new partner domain.
- Move the application control rule to block once alerts show no legitimate use; keep a documented rollback (policy back to audit).
- On a confirmed infection, isolate the host, revoke the user's sessions and refresh tokens, reset passwords stored in the browser, and remove any new local accounts.
- Hunt across the estate for the same chat sender, file names and C2 domains; reimage affected hosts. See the Malware Outbreak Playbook.
Metrics that show it is working
- Share of endpoints where AutoIt and script hosts are blocked for standard users.
- Number of external Teams first-contact chats per week, before and after allow-listing.
- Median time from an AutoIt or side-loading alert to isolation.
- Number of unexplained local account creations on workstations (target: zero).
Practitioner checklist
- Set Teams external access to allow-listed domains, or block it if you do not need it.
- Block execution of AutoIt and script interpreters from user-writable folders.
- Alert on double-extension shortcut execution and on signed binaries loading unsigned DLLs from their own folder.
- Alert on local account creation and Administrators group changes on workstations.
- Sandbox files downloaded from collaboration platforms, not just email attachments.
- Include session and token revocation in every infostealer or RAT response runbook.
- Track DarkGate's ATT&CK entry and vendor reports for new delivery routes each quarter.
Standards and references
- MITRE ATT&CK: DarkGate (S1111)
- MITRE ATT&CK: Water Curupira Pikabot Distribution (C0037)
- MITRE ATT&CK: AutoHotKey & AutoIT (T1059.010)
- MITRE ATT&CK: DLL (T1574.001)
- Trellix: The Continued Evolution of the DarkGate Malware-as-a-Service
- Fortinet (enSilo): Enter The DarkGate, New Cryptocurrency Mining and Ransomware Campaign
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Malware Loaders and Droppers Guide · Microsoft Teams Security Guide · Email Bombing and Help Desk Impersonation over Teams Guide · Application Allowlisting Guide