WithSecure researchers have tracked attacks using DarkGate malware to an active cluster of cybercriminals operating out of Vietnam.<\/p>\n\n\n\n
DarkGate is a Remote Access Trojan (RAT) that has been used in attacks since at least 2018 and is currently available to cybercriminals as Malware-as-a-Service (MaaS). It has a diverse user base and a variety of capabilities. It has been observed in information stealing, cryptojacking and ransomware campaigns.<\/p>\n\n\n\n
WithSecure researchers began their investigation into DarkGate after detecting multiple infection attempts against organisations in the UK, US and India.<\/p>\n\n\n\n
Based on non-technical indicators, such as lure files, themes, targeting and delivery methods, researchers were able to tie these attempted attacks back to the same threat actors using the Ducktail infostealer that WithSecure researchers have been tracking for approximately the last year and half.<\/p>\n\n\n\n
\u201cThe DarkGate attacks we observed have very strong identifiers \u2014 identifiers which allowed us to establish links between these attacks and others we\u2019ve seen using different infostealers and malware, including Ducktail. Based on what we\u2019ve observed, it is very likely that a single actor is behind several of the campaigns we\u2019ve been tracking that target Meta Business accounts,\u201d said WithSecure Senior Threat Intelligence Analyst, Stephen Robinson. <\/p>\n","protected":false},"excerpt":{"rendered":"
WithSecure researchers have tracked attacks using DarkGate malware to an active cluster of cybercriminals operating out of Vietnam. DarkGate is a Remote Access Trojan (RAT) that has been used in attacks since at least 2018 and is currently available to cybercriminals as Malware-as-a-Service (MaaS). It has a diverse user base and a variety of capabilities. […]<\/p>\n","protected":false},"author":21,"featured_media":31246,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1463,18,51,44,54],"tags":[5144,5145,5146,437,5147],"class_list":["post-31131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apac","category-enterprise-security","category-intelligent-technology-newsletter","category-top-stories","category-used","tag-darkgate","tag-malware-as-a-service","tag-remote-access-trojan","tag-vietnam","tag-withsecure"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/31131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/comments?post=31131"}],"version-history":[{"count":2,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/31131\/revisions"}],"predecessor-version":[{"id":31605,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/31131\/revisions\/31605"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media\/31246"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media?parent=31131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/categories?post=31131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/tags?post=31131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}