[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/darkgate-malware-uses-excel-files/) * [Japanese](https://unit42.paloaltonetworks.com/ja/darkgate-malware-uses-excel-files/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # DarkGate: Dancing the Samba With Alluring Excel Files ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 14 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Code to Cloud Platform icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Code to Cloud Platform](https://unit42.paloaltonetworks.com/product-category/code-to-cloud-platform/ "Code to Cloud Platform")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/product-category/prisma-cloud/ "Prisma Cloud")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Vishwa Thothathri](https://unit42.paloaltonetworks.com/author/vishwa-thothathri/) * [Yijie Sui](https://unit42.paloaltonetworks.com/author/yijie-sui/) * [Anmol Maurya](https://unit42.paloaltonetworks.com/author/anmol-maurya/) * [Uday Pratap Singh](https://unit42.paloaltonetworks.com/author/uday-pratap-singh/) * [Brad Duncan](https://unit42.paloaltonetworks.com/author/brad-duncan/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:July 10, 2024 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Anti-analysis](https://unit42.paloaltonetworks.com/tag/anti-analysis/) * [AutoIT](https://unit42.paloaltonetworks.com/tag/autoit/) * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/) * [Microsoft Excel](https://unit42.paloaltonetworks.com/tag/microsoft-excel/) * [Sandbox](https://unit42.paloaltonetworks.com/tag/sandbox/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/darkgate-malware-uses-excel-files/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/darkgate-malware-uses-excel-files/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=DarkGate:%20Dancing%20the%20Samba%20With%20Alluring%20Excel%20Files&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkgate-malware-uses-excel-files%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkgate-malware-uses-excel-files%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkgate-malware-uses-excel-files%2F&title=DarkGate:%20Dancing%20the%20Samba%20With%20Alluring%20Excel%20Files "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkgate-malware-uses-excel-files%2F&text=DarkGate:%20Dancing%20the%20Samba%20With%20Alluring%20Excel%20Files "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkgate-malware-uses-excel-files%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=DarkGate:%20Dancing%20the%20Samba%20With%20Alluring%20Excel%20Files%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkgate-malware-uses-excel-files%2F "Share in Mastodon") ## **Executive Summary** This article reviews a DarkGate malware campaign from March-April 2024 that uses Microsoft Excel files to download a malicious software package from public-facing SMB file shares. This was a relatively short-lived campaign that illustrates how threat actors can creatively abuse legitimate tools and services to distribute their malware. First reported in 2018, DarkGate has evolved into a malware-as-a-service (MaaS) offering. We have seen a surge of DarkGate activity after the disruption of Qakbot infrastructure in August 2023. Palo Alto Networks customers are better protected from DarkGate and other malware families through our [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall) with [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) that include [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire), [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering) and [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention). [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) can block malicious samples. The [Prisma Cloud Defender Agent](https://docs.prismacloud.io/en/classic/compute-admin-guide/technology-overviews/defender-architecture) can detect the malware files referenced in this article using signatures generated by Advanced WildFire products and protect cloud-based VMs. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**DarkGate**](https://unit42.paloaltonetworks.com/tag/darkgate/), **[Sandbox](https://unit42.paloaltonetworks.com/tag/sandbox/)** | |----------------------------|------------------------------------------------------------------------------------------------------------------------------------| **DarkGate Background** DarkGate is a malware family first [documented by enSilo in 2018](https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign). At that time, this threat ran with an advanced command and control (C2) infrastructure staffed by human operators responding to notifications of newly infected machines that had contacted its C2 server. DarkGate has since evolved to become a MaaS offering with a tightly controlled [number of customers](https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/#intro). DarkGate has advertised various capabilities including hidden virtual network computing (hVNC), remote code execution, cryptomining and reverse shell. An account named RastaFarEye posts updates and project information about DarkGate on the underground cybercrime market in the [Exploit.IN forum](https://falconfeeds.io/blog/post/uncovering-the-dark-web-underground-forum-exploitin-a-nexus-for-illicit-cyber-activities-603888) and the [XSS.is forum](https://medium.com/@qbruiqrsetioj/unveiling-the-wonders-of-xss-is-forum-a-dive-into-the-digital-realm-82b73a80955a). Figure 1 below shows an October 2023 post by RastaFarEye announcing fixes and features for DarkGate version 5. ![Screenshot of a forum post by user RastaFarEye titled 'UPDATE' discussing various technical updates and bug fixes related to software. The post includes file download and scanner links, and an announcement about a discount on a product subscription.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-57196-135464-1.png) Figure 1. Exploit.IN forum post by DarkGate developer RastaFarEye in October 2023. Source: [Trellix](https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/). DarkGate remained relatively [under the radar until 2021](https://medium.com/s2wblog/detailed-analysis-of-darkgate-investigating-new-top-trend-backdoor-malware-0545ecf5f606#:~:text=DarkGate%20was%20not%20widely%20used%20until%202021%2C%20although%20it%20was,the%20analysis%20report%20of%20DarkGate.). Our telemetry revealed a surge in DarkGate [starting in September 2023](https://www.linkedin.com/posts/unit42_darkgate-timelythreatintel-wireshark-activity-7123453508560797697--dJn/) (shown in Figure 2), not too long after the multinational government disruption and [takedown of Qakbot infrastructure in August 2023](https://www.justice.gov/opa/pr/qakbot-malware-disrupted-international-cyber-takedown). ![Bar graph displaying data over a period with dates on the horizontal axis ranging from August 1, 2023 to March 1, 2024 and a count on the vertical axis from 0 to 15. The bars show fluctuating values, peaking around November 2023.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-62102-135464-2.png) Figure 2. Hits on DarkGate malware samples from our telemetry. These campaigns use [AutoIt](https://www.splunk.com/en_us/blog/security/enter-the-gates-an-analysis-of-the-darkgate-autoit-loader.html) or [AutoHotkey scripts](https://securityintelligence.com/news/malware-using-autohotkey-scripts/) to infect victims with DarkGate. Our telemetry indicates this activity has been widespread across North America and Europe as well as significant portions of Asia. As early as January 2024, DarkGate released its sixth major version, which was reported [by Spamhaus as an updated sample](https://x.com/spamhaus/status/1750491586494873904) that was identified as version 6.1.6. Since August 2023, we have seen campaigns using various methods to distribute DarkGate malware, such as the following: * Tricking victims into downloading the [DarkGate installer from a link sent over Teams chat](https://www.linkedin.com/posts/unit42_darkgate-timelythreatintelligence-threatintel-activity-7118377814826905600-idoc/) * Using email attachments to get victims to [download and run content from a cabinet (.cab) archive](https://www.linkedin.com/posts/unit42_darkgate-timelythreatintel-wireshark-activity-7123453508560797697--dJn/) * An infection chain that uses [DLL side-loading by a legitimate program](https://www.linkedin.com/posts/unit42_darkgate-timelythreatintel-malwaretraffic-activity-7136107640379637760-F4OH/) to install DarkGate * PDF attachments with links to download ZIP archives that contain [Windows shortcut (.lnk) files to retrieve and install DarkGate](https://www.linkedin.com/posts/unit42_darkgate-timelythreatintel-threatintelligence-activity-7138645787709767680-mgL_/) * An infection chain that [uses ZIP archives containing URL files](https://www.linkedin.com/posts/unit42_darkgate-unit42threatintel-timelythreatintel-activity-7156413691289116672-W3GG/) to download and install DarkGate * An [infection chain that uses Java archive (.jar) files](https://www.forcepoint.com/blog/x-labs/phishing-script-inside-darkgate-campaign) to infect vulnerable hosts with DarkGate * Using HTML (.html) files to [trick users into copying and pasting malicious scripts into the Windows Run bar](https://www.linkedin.com/posts/unit42_darkgate-timelythreatintel-unit42threatintel-activity-7196580114761928704-Nblk/) to infect their hosts with DarkGate * [Malicious ads distributing DarkGate malware](https://www.malwarebytes.com/blog/threat-intelligence/2023/08/darkgate-reloaded-via-malvertising-campaigns) [Starting in March 2024](https://www.linkedin.com/posts/unit42_darkgate-unit42threatintel-timelythreatintel-activity-7176227299975946241-o6qb/), we saw a campaign using servers running open [Samba]() file shares hosting files used for DarkGate infections. Our analysis for this article focuses on this campaign, which ran from March-April of 2024. ## **Analysis of March-April 2024 Campaign** In March 2024, the actors behind DarkGate began a new campaign using Microsoft Excel (.xlsx) files, which mostly targeted North America in the beginning but slowly spread to Europe as well as parts of Asia. Our telemetry indicates some peaks of activity, with the standout on April 9, 2024, with almost 2,000 samples on that single day as shown below in Figure 3. ![The image displays a bar chart tracking data from March 3, 2024 to April 28, 2024. There is a spike on April 9, 2024.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-64749-135464-3.png) Figure 3. DarkGate malware samples from our telemetry from March through April 2024. Initially, the files all had similar nomenclature, which was part of what made them suspicious. The URLs they were from were quite dissimilar, and the companies accessing them were as well. Some popular names were: * paper\-\-march-2024.xlsx * march-D\-2024.xlsx * ACH-\-\March.xlsx * attach#\-\<\.xlsx * 01 CT John Doe.xlsx (where John Doe is replaceable by any common English name) * april2024-\.xlsx * statapril2024-\<\.xlsx These names are designed to suggest something official/important. If the user opens the .xlsx file in Excel, they are shown the template, pictured in Figure 4 below, that contains a linked object for the Open button. ![Screenshot of Excel Online interface displaying a message about files from the cloud, with an 'Open' button to enable editing.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-67180-135464-4.png) Figure 4. Template used by .xlsx files used in this DarkGate campaign. When a user clicks the hyperlinked object for the Open button in the spreadsheet, it retrieves and runs content from a URL found in the spreadsheet archive's drawing.xml.rels file. This URL points to a Samba/SMB share that is publicly accessible and hosts a VBS file. An example is: * file:///\\\\167.99.115\[.\]33\\share\\EXCEL\_OPEN\_DOCUMENT.vbs As the attack further evolved, the attackers also started sharing JS files from these Samba shares. * file:///\\\\5.180.24\[.\]155\\azure\\EXCEL\_DOCUMENT\_OPEN.JS.......... While the Microsoft Azure cloud service platform (CSP) is mentioned within the URL, there is no known connection between this malware and the Azure CSP. The threat actors could use this tactic to give the URL a sense of legitimacy and to avoid or obscure detection. The EXCEL\_OPEN\_DOCUMENT.vbs file contains a large amount of junk code related to printer drivers, but the important script that retrieves and runs the follow-up PowerShell script is highlighted below in Figure 5. ![A screenshot displaying a section of computer code in an IDE. The code includes error handling constructs in a programming language, with keywords like 'if', 'echo', 'set', and 'end if' prominently featured. Several lines are indenting for logical structure. The image shows a focus on generating and handling error messages with placeholders for user text and system descriptions. Several lines are highlighted in purple.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-70615-135464-5.png) Figure 5. Section of code from EXCEL\_OPEN\_DOCUMENT.vbs with code to request and run the next stage PowerShell script highlighted in purple. For Excel files with embedded objects that use Samba links to .js files instead of .vbs files, the JavaScript shows a similar function to retrieve and run the follow-up PowerShell script. Figure 6 shows a file named 11042024\_1545\_EXCEL\_DOCUMENT\_OPEN.js that performs this similar function. ![Screenshot of computer code written in a programming environment. The code snippet features function definitions and script execution commands using PowerShell and ActiveXObject to perform web-based actions. The URI included in the script is "wassonsite dot com/yrqnsfla". The functions are named "wbbnrkg" and involve popup and run methods.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-73277-135464-6.png) Figure 6. Section of code from a .js file to run the next-stage PowerShell script. Code from the .vbs or .js file downloads and runs a PowerShell script. This PowerShell script downloads three files and uses them to start the AutoHotKey-based DarkGate package. An example is shown below in Figure 7. ![Screenshot displaying a PowerShell script involving commands for changing directory, downloading files using Invoke-WebRequest, executing scripts, and modifying file attributes. The script includes URLs and file names like 'a.bin', 'script.ahk', and 'test.txt'.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-75631-135464-7.png) Figure 7. PowerShell script to download and run the AutoHotKey-based DarkGate package. In some cases, these PowerShell scripts attempt an interesting evasion tactic. Below in Figure 8, we find an example of a PowerShell script that checks if Kaspersky anti-malware software is installed by detecting if the directory C:/ProgramData/Kaspersky Lab exists. If this directory exists, the PowerShell script downloads the legitimate AutoHotKey.exe, possibly as an evasion tactic to avoid triggering Kaspersky anti-malware. If C:/ProgramData/Kaspersky Lab does not exist, the PowerShell script downloads ASCII text representing hexadecimal code for Autohotkey.exe, saves the result as a.bin and uses certutil.exe with the -decodehex parameter to decode a.bin to the AutoHotKey.exe binary. Figure 8 shows details of this script. ![Screenshot displaying a script. The script includes various command lines in PowerShell, focusing on web requests, file handling, and execution of an AutoHotkey script. The text editor has a dark background with colored syntax highlighting to differentiate commands, parameters, and strings. A large section is highlighted in purple.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-77822-135464-8.png) Figure 8. PowerShell script to install DarkGate with the check for Kaspersky anti-malware software highlighted in purple. We have also found similar checks and evasion techniques in AutoHotKey scripts (.ahk) and AutoIt3 scripts (.au3 or .a3x) in the DarkGate package. The PowerShell script in Figures 7 and 8 both show a filename test.txt. This file is the final shellcode for DarkGate, but it is obfuscated. The legitimate Autohotkey.exe runs the malicious AutoHotKey script script.ahk, which deobfuscates the test.txt and loads it into memory to run as the DarkGate executable. The script.ahk file has several comment lines with random English words that inflate the file to more than 50 KB. The functional AutoHotKey script is only 13 lines of code. Figure 9 below shows an example of this functional script. ![The image displays a snippet of computer code. It involves memory operations with API calls such as "VirtualAlloc" and contains detailed parameters and function usage. The text mentions file manipulation, involving reading from a file "text.txt" located in the script directory. The image also includes explicit usage of data types like "UInt", "Char", and includes hexadecimal constants and operations. There is also an execution of a Dynamic Link Library (DLL) via "DllCall". The code is highlighted in syntax-coloring common in development environments, enhancing readability.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-80330-135464-9.png) Figure 9. An example of script.ahk stripped of its comment lines. ## **A Closer Look at DarkGate Malware** Deobfuscated from test.txt and run from system memory, this final DarkGate binary is known for its complex mechanisms to avoid detection and malware analysis. By analyzing its shellcode, we can gain a deeper understanding of the malware's functionality and identify ways to counteract its anti-analysis techniques. ### **Checking CPU Information as an Anti-Analysis Technique** One of the anti-analysis techniques employed by DarkGate is identifying the CPU of the targeted system. This can reveal if the threat is running in a virtual environment or on a physical host, enabling DarkGate to cease operations to avoid being analyzed in a controlled environment. Figure 10 shows the routine to check for a victim system's CPU when analyzing the final DarkGate executable in a debugger. ![Screenshot of computer code in an IDE showing function calls and a highlighted text line displaying CPU specification: "Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz @ 2 Cores."](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-82840-135464-10.png) Figure 10. DarkGate's routine to check for the CPU shown in a debugger. ### **Detecting Multiple Anti-Malware Programs** In addition to checking CPU information, DarkGate malware also scans for multiple other anti-malware programs on the targeted system. By identifying installed anti-malware software, DarkGate can avoid triggering their detection mechanisms or even disable them to further evade analysis. Table 1 lists the anti-malware programs and their corresponding directory paths or filenames, which DarkGate uses to detect their presence on a system. |-------------------------|-----------------------------------------------------------------------| | **Anti-Malware Brands** | **Checks for Location (Directory) or Running Process (Filename)** | | Bitdefender | C:\\ProgramData\\BitdefenderC:\\Program Files\\Bitdefender | | SentinelOne | C:\\Program Files\\SentinelOne | | Avast | C:\\ProgramData\\AVASTC:\\Program Files\\AVAST Software | | AVG | C:\\ProgramData\\AVG C:\\Program Files\\AVG | | Kaspersky | C:\\ProgramData\\Kaspersky Lab C:\\Program Files (x86)\\Kaspersky Lab | | Eset-Nod32 | C:\\ProgramData\\ESET egui.exe (ESET GUI) | | Avira | C:\\Program Files (x86)\\Avira | | Norton | ns.exe nis.exe nortonsecurity.exe | | Symantec | smc.exe | | Trend Micro | uiseagnt.exe | | McAfee | mcuicnt.exe | | SUPERAntiSpyware | superantispyware.exe | | Comodo | vkise.exe cis.exe | | Malwarebytes | C:\\Program Files\\Malwarebytes mbam.exe | | ByteFence | bytefence.exe | | Search \& Destroy | sdscan.exe | | 360 Total Security | qhsafetray.exe | | Total AV | totalav.exe | | IObit Malware Fighter | C:\\Program Files (x86)\\IObit | | Panda Security | psuaservice.exe | | Emsisoft | C:\\ProgramData\\Emsisoft | | Quick Heal | C:\\Program Files\\Quick Heal | | F-Secure | C:\\Program Files (x86)\\F-Secure | | Sophos | C:\\ProgramData\\Sophos | | G DATA | C:\\ProgramData\\G DATA | | Windows Defender | C:\\Program Files (x86)\\Windows Defender | Table 1. Anti-malware programs and their directory paths. As DarkGate has evolved, its developers have implemented updates to include new anti-malware checks, such as those for Windows Defender and SentinelOne. This demonstrates the malware's continuous evolution and adaptation to bypass the latest security measures. ### **Identifying Malware Analysis and Anti-VM Tools** DarkGate malware not only checks for CPU information and anti-malware programs but also scans the host's running processes. It does this to ensure normal Windows processes are running, but no processes that could be used for malware analysis or processes that indicate a virtual machine (VM) environment. Unwanted processes can include popular reverse engineering tools, debuggers or virtualization software. Identifying these processes helps DarkGate take appropriate action to avoid detection or hinder analysis of the malware. Figure 11 shows the output of a debugger from a DarkGate sample checking through running processes for VM-related programs or malware analysis tools. This reveals several strings that relate to normal Windows processes and others for VM environments and malware analysis tools. DarkGate checks for these on an infected host before proceeding with its infection activity. ![Screen filled with hexadecimal code and corresponding ASCII text, showing various system processes like 'svchost.exe' and 'smsvchost.exe.'](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/image15-655x700.png) Figure 11. Output from a debugger, revealing names of various processes identified by a DarkGate sample. The list of active programs or processes that the DarkGate sample checked through (also in Figure 11) is shown below: * system * smss.exe * csrss.exe * wininit.exe * winlogon.exe * services.exe * lsass.exe * svchost.exe * dwm.exe * spoolsv.exe * VGAuthService.exe * Vm3dservice.exe (VMware process for video rendering) * Vmtoolsd.exe (VMware process for VMware tools) * MsMpEng.exe * dllhost.exe * WmiPrvSE.exe * sihost.exe * GoogleUpdate.exe * taskhostw.exe * RuntimeBroker.exe * explorer.exe * msdtc.exe * SearchIndexer.exe * ShellExperienceHost.exe * NisSrv.exe * OneDrive.exe * sedsvc.exe * X32dbg.exe (Debugging software) * Ida.exe (IDA binary code analysis tool) * ProcessHacker.exe (Process Hacker analysis tool) * notepad++.exe * OutputPE.exe * SearchUI.exe * audiodg.exe ### **Decryption of Configuration Data** After gathering information about the targeted system's hardware, anti-malware programs and running processes, DarkGate malware incorporates this data into its decryption routine for its configuration. This configuration consists of multiple fields, each containing specific information the malware uses to adapt its behavior and evade detection. By adjusting its actions based on the collected data, the malware can better avoid analysis and remain hidden on the infected system. In the most recent versions of DarkGate, the function to decrypt the configuration receives the encrypted buffer, buffer size and a hard-coded XOR key as inputs. It then creates a new decryption key using the provided key and proceeds to decrypt the configuration buffer as shown in Figures 12 and 13. Figure 12 shows the output of a debugger from a DarkGate sample first seen on March 14, 2024, after decrypting its configuration data. ![The image displays a screen of densely packed hexadecimal codes interspersed with ASCII characters, indicative of a data dump or computer code analysis. The included text references URLs, data references, and various technical terms.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-92105-135464-12.png) Figure 12. Configuration data extracted from a DarkGate sample first seen on March 14, 2024. Figure 13 shows the output of a debugger from a DarkGate sample first seen on April 16, 2024, after decrypting its configuration data. ![A screen filled with hexadecimal numerical values and scattered ASCII characters.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-96871-135464-13.png) Figure 13. Configuration data extracted from a DarkGate sample first seen on April 16, 2024. We recently analyzed the configurations from DarkGate malware samples from a variety of campaigns. The fields appear as numbers with no description, but additional research can correlate some of these fields to functions or values of the malware sample. For example, the raw configuration data shows 25=admin888 in Figures 12 and 13, and further analysis indicates this admin888 is the campaign identifier for those malware samples. In some cases, the meaning of these fields is not clear. For example, Figures 12 and 13 both reveal an entry labeled 14=Yes, but we have not confirmed the specific function or value of this entry. Despite these unknown field values, the configuration data can reveal interesting details of DarkGate samples. For example, we found several different hard-coded XOR keys from samples using the same campaign identifier. And some samples with different XOR keys had not only the same campaign identifier, but also the same value for their C2 server. The different XOR keys for samples with otherwise similar configuration characteristics could possibly be an attempt to hinder analysis of DarkGate samples. Let's review some examples of configuration data illustrating notable differences in XOR keys. These values are shown in JSON format, so numbers for any unidentified fields are prefaced with the string flag\_. For example, 14=Yes from the raw configuration data is shown as "flag\_14": "Yes", in JSON format. #### Same Campaign Identifier, Different XOR Keys Table 2 shows the decrypted configuration comparing two samples from May 2024 in JSON format with the same campaign\_id value but different xor\_key values. |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Configuration From DarkGate Sample Seen as Early as May 7, 2024** | **Configuration From DarkGate Sample Seen as Early as May 20, 2024** | | "C2": "updateleft.com", "check\_ram": false, "crypter\_rawstub": "DarkGate", "crypter\_dll": "R0ijS0qCVITtS0e6xeZ", "crypter\_au3": 6, "flag\_14": true, "port": 80, "startup\_persistence": true, "flag\_32": false, "anti\_vm": true, "min\_disk": false, "min\_disk\_size": 100, "anti\_analysis": true, "min\_ram": false, "min\_ram\_size": 4096, "check\_disk": false, "flag\_21": false, "flag\_22": false, "flag\_23": true, "flag\_31": false, "flag\_24": ".newtarget", **"campaign\_id": "admin888"**, "flag\_26": false, **"xor\_key": "SbCjRKFB"** , "flag\_28": false, "flag\_29": 2 | "C2":"wear626.com", "flag\_8": "No", "crypter\_rawstub": "DarkGate", "crypter\_dll": "R0ijS0qCVITtS0e6xeZ", "crypter\_au3": "6", "flag\_14": "Yes", "port": "80", "startup\_persistence": "No", "flag\_32": "No", "check\_display": "Yes", "check\_disk": "No", "min\_disk\_size": "100", "check\_ram": "No", "min\_ram\_size": "4096", "check\_xeon": "No", "flag\_21": "Yes", "flag\_22": "No", "flag\_23": "No", "flag\_31": "No", "flag\_24": "traf", **"campaign\_id": "admin888"** , "flag\_26": "No", **"xor\_key": "TNduHZgm"** , "flag\_28": "No", "flag\_29": "2", "flag\_34": "No" | Table 2. Configuration comparison from two DarkGate samples with the same campaign identifier but different hard-coded XOR keys. #### Same Campaign Identifier and C2 Server, Different XOR Keys Table 3 shows the decrypted configuration comparing two samples from April 2024 in JSON format with the same C2 and campaign\_id values but different xor\_key values. |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Configuration From DarkGate Sample Seen As Early as April 10, 2024** | **Configuration From DarkGate Sample Seen As Early as April 27, 2024** | | **"C2":"78.142.18.222"**, "flag\_8": "No", "crypter\_rawstub": "DarkGate", "crypter\_dll": "R0ijS0qCVITtS0e6xeZ", "crypter\_au3": "6", "flag\_14": "Yes", "port": "80", "startup\_persistence": "No", "flag\_32": "No", "check\_display": "No", "check\_disk": "No", "min\_disk\_size": "100", "check\_ram": "No", "min\_ram\_size": "4096", "check\_xeon": "No", "flag\_21": "Yes", "flag\_22": "No", "flag\_23": "No", "flag\_31": "No", **"campaign\_id": "tompang,** "flag\_26": "No", **"xor\_key": "ClUqWMEv"**, "flag\_28": "No", "flag\_29": "6", "flag\_33": "No" | **"C2":"78.142.18.222"**, "flag\_8": "No", "crypter\_rawstub": "DarkGate", "crypter\_dll": "R0ijS0qCVITtS0e6xeZ", "crypter\_au3": "6", "flag\_14": "Yes", "port": "80", "startup\_persistence": "No", "flag\_32": "No", "check\_display": "No", "check\_disk": "No", "min\_disk\_size": "100", "check\_ram": "No", "min\_ram\_size": "4096", "check\_xeon": "No", "flag\_21": "Yes", "flag\_22": "No", "flag\_23": "No", "flag\_31": "No", **"campaign\_id": "tompang",** "flag\_26": "No", **"xor\_key": "VzJaSPos"**, "flag\_28": "No", "flag\_29": "2" | Table 3. Configuration comparison from two DarkGate samples with the same campaign identifier and the same C2 server but different hard-coded XOR keys. ## **DarkGate C2 Traffic** DarkGate C2 traffic uses unencrypted HTTP requests, but the data is obfuscated and appears as Base64-encoded text. Figure 14 shows the initial HTTP POST request for C2 traffic from a DarkGate infection on March 14, 2024. ![A screenshot of Wireshark software displaying an HTTP stream, capturing and showing detailed network packet data with various headers and hexadecimal values visible on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-101797-135464-14.jpeg) Figure 14. Text stream of the initial HTTP POST request from a DarkGate infection on March 14, 2024. This Base64-encoded text can be decoded, but the result is further obfuscated. [Other research](https://blog.sekoia.io/darkgate-internals/) reveals how this data can be fully deobfuscated. In our infection run March 14, 2024, we saw what appears to have been data exfiltration in five HTTP POST requests sending nearly 218 KB of data as shown below in Figure 15. ![The image shows a screenshot of a network traffic log from Wireshark displayed in a table format. The columns are labeled from left to right as Time, ID, Dot, port, Host, Content-Length, and Info. The rows list different network exchanges with entries detailing timestamps in 'YYYY-MM-DD hh:mm:ss' format, various IP addresses under 'Dot', port numbers, and the domain 'nextroundstr.com' under 'Host'. All the traffic requests are POST requests shown under the 'Info' column. Some rows feature black arrows pointing to the right, indicating specific entries highlighted within the log.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-105205-135464-15.jpeg) Figure 15. HTTP POST requests for DarkGate C2 traffic filtered in Wireshark, showing possible data exfiltration. When reviewing a text stream of the traffic, this possible data exfiltration also shows as Base64-encoded text sent over HTTP POST requests. Figure 16 shows one such example from the infection from March 14, 2024. ![A screenshot of Wireshark software displaying an HTTP stream, capturing and showing detailed network packet data with various headers and hexadecimal values visible on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-108788-135464-16.jpeg) Figure 16. Text stream of an HTTP post sending approximately 218 KB of information for possible data exfiltration. While we've seen indicators of data exfiltration from DarkGate C2 traffic, other sources have reported [follow-up malware from DarkGate like Danabot](https://www.esentire.com/blog/from-darkgate-to-danabot). Furthermore, threat actors reportedly using the DarkGate MaaS have previously been [associated with ransomware activity](https://blog.eclecticiq.com/darkgate-opening-gates-for-financially-motivated-threat-actors). **Conclusion** DarkGate malware represents a significant and adaptable threat in the cybercrime ecosystem, possibly filling the gap left by the dismantlement of Qakbot after August 2023. With its multi-faceted attack vectors and evolution into a full-fledged MaaS offering, DarkGate demonstrates a high level of complexity and persistence. Campaigns using this malware exhibit advanced infection techniques, leveraging both phishing strategies and approaches like exploiting publicly accessible Samba shares. As DarkGate continues to evolve and refine its methods of infiltration and resistance to analysis, it remains a potent reminder of the need for robust and proactive cybersecurity defenses. ## **Product Protection** Palo Alto Networks customers are better protected from the threats discussed in this article through the following products: * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) blocks the DarkGate samples referenced in this post as well as the various stages and payloads, and it provides extensive protection through cloud-based static and dynamic analysis capabilities. * [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with [Cloud-Delivered Security Services](https://docs.paloaltonetworks.com/cdss) including [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire), [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering) and [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) are able to recognize these domains or C2 URLs as malicious. They can also instrument the full attack chain and identify the malicious behaviors and anti-sandbox evasions. Examples of signatures include: * Virus/Win32.WGeneric.efigim * Virus/Win32.WGeneric.efypas * Virus/Win32.WGeneric.efhzig * Next Generation Firewall with the Advanced Threat Prevention security subscription can help block the attacks with best practices via the following Threat Prevention signature: [86902](https://threatvault.paloaltonetworks.com/?query=86902). * The [Prisma Cloud Defender Agent](https://docs.prismacloud.io/en/classic/compute-admin-guide/technology-overviews/defender-architecture) can detect the malware files referenced in this article using signatures generated by Advanced WildFire products and protect cloud-based VMs. If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## **Indicators of Compromise** SHA256 hashes for initial lures used in the March-April 2024 campaign distributing DarkGate malware: |------------------------------------------------------------------|---------------------------------------------------------------------------| | **SHA256 Hash** | **File Description** | | 378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7 | XLSX file containing embedded object pointing to SMB URL hosting JS file | | ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9 | XLSX file containing embedded object pointing to SMB URL hosting VBS file | | a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6 | XLSX file containing embedded object pointing to SMB URL hosting VBS file | | 02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29 | XLSX file containing embedded object pointing to SMB URL hosting VBS file | | 2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32 | XLSX file containing embedded object pointing to SMB URL hosting VBS file | | 4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503 | XLSX file containing embedded object pointing to SMB URL hosting VBS file | | 08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba | XLSX file containing embedded object pointing to SMB URL hosting VBS file | | 4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503 | XLSX file containing embedded object pointing to SMB URL hosting VBS file | | 08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba | XLSX file containing embedded object pointing to SMB URL hosting VBS file | | 585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53 | XLSX file containing embedded object pointing to SMB URL hosting JS file | | 51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3 | XLSX file containing embedded object pointing to SMB URL hosting JS file | | 44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096 | XLSX file containing embedded object pointing to SMB URL hosting JS file | | b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1 | XLSX file containing embedded object pointing to SMB URL hosting JS file | Examples of SHA256 hashes for JS or VBS files used for DarkGate infections: * 96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13 * F9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0 * 2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f Examples of SHA256 hashes for PowerShell scripts used for DarkGate infections: * 9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780 * 9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29 * 51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7 * b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd SHA256 hash for copy of AutoHotKey EXE used for these infections (not malicious): * 897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb Examples the URLs used to retrieve and run AutoHotKey packages for DarkGate malware: March 12, 2024: * hxxp://adfhjadfbjadbfjkhad44jka\[.\]com/aa * hxxp://adfhjadfbjadbfjkhad44jka\[.\]com/xxhhodrq * hxxp://adfhjadfbjadbfjkhad44jka\[.\]com/zanmjtvh March 13, 2024: * hxxp://nextroundst\[.\]com/aa * hxxp://nextroundst\[.\]com/ffcxlohx * hxxp://nextroundst\[.\]com/nlcsphze March 15, 2024: * hxxp://diveupdown\[.\]com/aa * hxxp://diveupdown\[.\]com/aaa * hxxp://diveupdown\[.\]com/hlsxaifp * hxxp://diveupdown\[.\]com/yhmrmmgc ## **Additional Resources** * [List of articles for DarkGate malware](https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate) -- Malpedia * [The DarkGate Menace: Leveraging Autohotkey \& Attempt to Evade Smartscreen](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/the-darkgate-menace-leveraging-autohotkey-attempt-to-evade-smartscreen/) -- McAfee Labs * [Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign](https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign) -- FortiGuard Labs * [Inside DarkGate: Exploring the infection chain and capabilities](https://www.logpoint.com/en/blog/inside-darkgate/) -- Logpoint * [The Continued Evolution of the DarkGate Malware-as-a-Service](https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/) -- Trellix * [DarkGate Internals](https://blog.sekoia.io/darkgate-internals/) -- Sekoia Blog * [Detailed Analysis of DarkGate; Investigating new top-trend backdoor malware](https://medium.com/s2wblog/detailed-analysis-of-darkgate-investigating-new-top-trend-backdoor-malware-0545ecf5f606) -- S2W Blog * [DarkGate - Threat Breakdown Journey](https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/) -- Toxin Labs * [From DarkGate to DanaBot](https://www.esentire.com/blog/from-darkgate-to-danabot) -- eSentire Blog Back to top ### Tags * [Anti-analysis](https://unit42.paloaltonetworks.com/tag/anti-analysis/ "anti-analysis") * [AutoIT](https://unit42.paloaltonetworks.com/tag/autoit/ "AutoIT") * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/ "DLL Sideloading") * [Microsoft Excel](https://unit42.paloaltonetworks.com/tag/microsoft-excel/ "Microsoft Excel") * [Sandbox](https://unit42.paloaltonetworks.com/tag/sandbox/ "Sandbox") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Dissecting GootLoader With Node.js](https://unit42.paloaltonetworks.com/javascript-malware-gootloader/ "Dissecting GootLoader With Node.js") ### Table of Contents * ### Related Articles * [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "article - table of contents") * [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ "article - table of contents") * [Tracking Iranian APT Screening Serpens' 2026 Espionage Campaigns](https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/ "article - table of contents") ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)