This growing malware threat actor is set to unleash a surge of attacks, experts warn
BattleRoyal is out there, and it wants to drop DarkGate on your endpoints
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
We’re about to witness a significant surge in the deployment of DarkGate and NetSupport, security experts are warning.
Researchers from Proofpoint claim to have observed a brand new threat actor, dubbed “BattleRoyal”. This threat actor mounted at least 20 email campaigns in the months between September and November this year, to deliver the DarkGatemalware.
In late November and early December, the group pivoted from DarkGate to NetSupport, a legitimate remote access tool frequently abused by hackers to establish persistence on targeted endpoints. Besides emails, the group also used a series of compromised websites and fake update lures to get people to download the malware.
Abusing a SmartScreen flaw
The reasons for the switch remain a mystery, with the researchers hinting it might be due to DarkGate drawing too much attention.
In any case, the group was abusing a vulnerability tracked as CVE-2023-36025 to deliver themalware. Other groups abused this flaw too, but the BattleRoyal cluster “exploited this vulnerability more than any other actor observed in Proofpoint threat data.” BattleRoyal was abusing it even before it was published byMicrosoft, the company said.
The flaw is found in Windows SmartScreen, a security feature designed to stop people from visiting dangerous websites. Proofpoint explained that the attackers could bypass SmartScreen defenses by getting the victim to click on a specially designed URL, which the vulnerability allowed.
As explained by Malpedia, DarkGate is a commodity loader first documented in 2018. It comes with numerous features, including the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, the ability to log keystrokes, steal sensitive information, and escalate privileges. DarkGate abuses legitimate AutoIt files and typically runs multiple AutoIt scripts.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
New versions of DarkGate have been advertised on a Russian-language eCrime forum since May 2023, the report concludes.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Herman Miller Aeron gaming chair review: premium, highly customizable comfort
