DarkGate Operators (RastaFarEye)

According to public reporting, DarkGate is a Malware-as-a-Service offering by a forum user named RastaFarEye.

The DarkGate Loader includes exploitation of vulnerabilities, cryptocurrency mining, remote access and continues to evolve over time. DarkGate has been picked up by multiple financially motivated groups, including those associated with ransomware.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

DarkGate Operators (RastaFarEye) Threat Reports

Report

Detailed Analysis of DarkGate

This post on Medium by S2W presents a technical analysis of DarkGate malware and the operator behind it. According to the report, DarkGate is a ...

View Source

Report

CVE-2024-21412: DarkGate Operators Exploit Microsoft Windows SmartScreen Bypass in Zero-Day Campaign

This report by TrendMicro's Zero Day Initiative describes a campaign associated with the DarkGate ransomware. According to the post, DarkGate ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

Search:

ATT&CK ID	Title	Associated Tactics
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1071.001	Web Protocols	Command and Control
T1219	Remote Access Software	Command and Control
T1057	Process Discovery	Discovery
T1529	System Shutdown/Reboot	Impact
T1005	Data from Local System	Collection
T1070.004	File Deletion	Defense Evasion
T1566.001	Spearphishing Attachment	Initial Access
T1555.003	Credentials from Web Browsers	Credential Access
T1560.001	Archive via Utility	Collection
T1547.001	Registry Run Keys / Startup Folder	Persistence, Privilege Escalation
T1555	Credentials from Password Stores	Credential Access
T1083	File and Directory Discovery	Discovery
T1204.002	Malicious File	Execution
T1217	Browser Information Discovery	Discovery
T1134.004	Parent PID Spoofing	Defense Evasion, Privilege Escalation
T1528	Steal Application Access Token	Credential Access
T1082	System Information Discovery	Discovery
T1041	Exfiltration Over C2 Channel	Exfiltration
T1132.002	Non-Standard Encoding	Command and Control
T1539	Steal Web Session Cookie	Credential Access
T1055.012	Process Hollowing	Defense Evasion, Privilege Escalation
T1056.001	Keylogging	Collection, Credential Access
T1105	Ingress Tool Transfer	Command and Control
T1574.002	DLL Side-Loading	Defense Evasion, Persistence, Privilege Escalation

Showing 1 to 25 of 25 entries

DarkGate Operators (RastaFarEye)

Cyber Threat Graph Context

DarkGate Operators (RastaFarEye) Threat Reports

Detailed Analysis of DarkGate

CVE-2024-21412: DarkGate Operators Exploit Microsoft Windows SmartScreen Bypass in Zero-Day Campaign

References

blog.eclecticiq.com

www.trendmicro.com

www.trendmicro.com

socradar.io

medium.com

MITRE ATT&CK Techniques