{
  "family": "darkgate",
  "sample_count": 1205,
  "category": "loader",
  "description": "DarkGate is a sophisticated, modular Malware-as-a-Service (MaaS) threat that functions as a loader, Remote Access Trojan (RAT), and info-stealer. Written in Delphi, it is infamous for its complex infection chains which often involve malicious MSI installers, AutoIt scripts, and LNK files.<br><br><b>What is DarkGate?</b><br>Following the takedown of the Qakbot botnet in 2023, DarkGate surged in popularity among cybercriminals looking for a reliable initial access payload. It is heavily obfuscated and includes built-in features for credential theft, keylogging, cryptocurrency mining, and remote desktop control via hVNC.<br><br><b>Infection Vectors & Threat Hunting</b><br>DarkGate is primarily distributed via highly targeted phishing emails containing malicious attachments (like PDFs with embedded links) or Microsoft Teams messages. The infection chain frequently uses living-off-the-land binaries (LOLBins) like <code>curl.exe</code> to download an AutoIt script, which then decodes and executes the DarkGate payload in memory. Threat hunters should monitor for unusual executions of <code>AutoIt3.exe</code> and unexpected network connections to dynamic DNS providers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "meh_crypter",
    "dark_gate"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What replaced Qakbot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DarkGate and Pikabot are considered the primary successors used by initial access brokers after Qakbot's takedown."
      }
    },
    {
      "@type": "Question",
      "name": "How is DarkGate distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Primarily through phishing emails and malicious Microsoft Teams messages containing MSI or LNK files."
      }
    }
  ],
  "faq_count": 2,
  "mitre_attack": [
    "T1566",
    "T1059",
    "T1055",
    "T1056",
    "T1071"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-31",
  "mitre_attack_detail": [
    {
      "id": "T1566",
      "name": "Phishing",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Block indicators of compromise associated with the DarkGate C2 infrastructure.",
    "Isolate infected hosts immediately as DarkGate enables full remote interactive control (hVNC)."
  ],
  "what_to_avoid": [
    "Avoid relying solely on static file scanning, as DarkGate payloads are often heavily obfuscated and executed strictly in memory."
  ]
}