"value":"Throughout the summer and fall of 2023, DarkGate entered the ring competing for the top spot in the remote access trojan (RAT) and loader category. It was observed in use by multiple cybercrime actors and was spread via many methods such as email, Microsoft Teams, Skype, malvertising and fake updates. \r\n\r\nProofpoint researchers are tracking a particularly interesting operator of the DarkGate malware. At the time of publication, researchers are not attributing this cluster of activity to a known threat actor and are temporarily calling it BattleRoyal. Between September and November 2023, at least 20 email campaigns used DarkGate malware with GroupIDs \u201cPLEX\u201d, \u201cADS5\u201d, \u201cuser_871236672\u201d and \u201cusr_871663321\u201d. The GroupID is a configuration setting that is also referred to as username, botnet, campaign, or flag 23. The campaigns are notable for:",
"category":"Other",
"uuid":"5a9a1330-4516-4fc0-8ab4-9ff7f4954c5f"
},
{
"type":"text",
"object_relation":"title",
"value":"BattleRoyal, DarkGate Cluster Spreads via Email and Fake Browser Updates",
"description":"Enriched via the url_import module",
"pattern":"[url:value = 'http://5.181.159.29:80/Downloads/12.url' AND url:x_misp_resource_path = '/Downloads/12.url' AND url:x_misp_port = '80' AND url:x_misp_host = '5.181.159.29' AND url:x_misp_domain_without_tld = '5.181.159.29' AND url:x_misp_domain = '5.181.159.29']",
"description":"Enriched via the url_import module",
"pattern":"[url:value = 'http://5.181.159.29:80/Downloads/evervendor.zip/evervendor.exe' AND url:x_misp_resource_path = '/Downloads/evervendor.zip/evervendor.exe' AND url:x_misp_port = '80' AND url:x_misp_host = '5.181.159.29' AND url:x_misp_domain_without_tld = '5.181.159.29' AND url:x_misp_domain = '5.181.159.29']",
"description":"Enriched via the url_import module",
"pattern":"[url:value = 'http://79.110.62.96:80/Downloads/bye.zip/bye.vbs' AND url:x_misp_resource_path = '/Downloads/bye.zip/bye.vbs' AND url:x_misp_port = '80' AND url:x_misp_host = '79.110.62.96' AND url:x_misp_domain_without_tld = '79.110.62.96' AND url:x_misp_domain = '79.110.62.96']",
"description":"Enriched via the url_import module",
"pattern":"[url:value = 'http://searcherbigdealk.com:2351/msizjbicvmd' AND url:x_misp_tld = 'com' AND url:x_misp_resource_path = '/msizjbicvmd' AND url:x_misp_port = '2351' AND url:x_misp_host = 'searcherbigdealk.com' AND url:x_misp_domain_without_tld = 'searcherbigdealk' AND url:x_misp_domain = 'searcherbigdealk.com']",
"description":"Enriched via the url_import module",
"pattern":"[url:value = 'http://searcherbigdealk.com:2351/zjbicvmd' AND url:x_misp_tld = 'com' AND url:x_misp_resource_path = '/zjbicvmd' AND url:x_misp_port = '2351' AND url:x_misp_host = 'searcherbigdealk.com' AND url:x_misp_domain_without_tld = 'searcherbigdealk' AND url:x_misp_domain = 'searcherbigdealk.com']",
"description":"Enriched via the url_import module",
"pattern":"[url:value = 'https://heilee.com/qxz3l' AND url:x_misp_tld = 'com' AND url:x_misp_resource_path = '/qxz3l' AND url:x_misp_host = 'heilee.com' AND url:x_misp_domain_without_tld = 'heilee' AND url:x_misp_domain = 'heilee.com']",
"description":"Enriched via the url_import module",
"pattern":"[url:value = 'https://kairoscounselingmi.com/wp-content/uploads/astra/help/pr-nv28-2023.url' AND url:x_misp_tld = 'com' AND url:x_misp_resource_path = '/wp-content/uploads/astra/help/pr-nv28-2023.url' AND url:x_misp_host = 'kairoscounselingmi.com' AND url:x_misp_domain_without_tld = 'kairoscounselingmi' AND url:x_misp_domain = 'kairoscounselingmi.com']",
"abstract":"Report from - https://www.proofpoint.com/us/blog/threat-insight/battleroyal-darkgate-cluster-spreads-email-and-fake-browser-updates (1703240419)",
"content":"#BattleRoyal,DarkGateClusterSpreadsviaEmailandFakeBrowserUpdates\r\n\r\nDecember21,2023AxelF,DustyMiller,TommyMadjarandSelenaLarson\r\n\r\n###Overview\r\n\r\nThroughoutthesummerandfallof2023,DarkGateenteredtheringcompetingforthetopspotintheremoteaccesstrojan(RAT)andloadercategory.Itwasobservedinusebymultiplecybercrimeactorsandwasspreadviamanymethodssuchasemail,MicrosoftTeams,Skype,malvertisingandfakeupdates.\r\n\r\nProofpointresearchersaretrackingaparticularlyinterestingoperatoroftheDarkGatemalware.Atthetimeofpublication,researchersarenotattributingthisclusterofactivitytoaknownthreatactorandaretemporarilycallingitBattleRoyal.BetweenSeptemberandNovember2023,atleast20emailcampaignsusedDarkGatemalwarewithGroupIDs\u201cPLEX\u201d,\u201cADS5\u201d,\u201cuser\\_871236672\u201dand\u201cusr\\_871663321\u201d.TheGroupIDisaconfigurationsettingthatisalsoreferredtoasusername,botnet,campaign,orflag23.Thecampaignsarenotablefor:\r\n\r\n\r\n***Delivery:**viaemailandRogueRaticatefakebrowserupdates\r\n***Volumesandgeography:**emailcampaignsincludetensofthousandsofemailstargetingdozensofindustriesprimarilyinUSAandCanada\r\n***Attackchain:**includesavarietyofnotabletoolssuchas404TDS,KeitaroTDS,and.URLfilesexploitingCVE-2023-36025\r\n\r\n*VolumeofDarkGatecampaignsbasedonfourGroupIDsdiscussedinthisreport.*\r\n\r\n###TDSallthethings!(anemailcampaignexample)\r\n\r\nOnOctober2,2023,Proofpointidentifiedoneofthefirstcampaignsinthiscluster.Itwasnotableduetotheuseofmorethanonetrafficdeliverysystem(TDS),specifically404TDSandKeitaroTDS.Additionally,the.URLfilesinvolvedexploitedCVE-2023-36025,avulnerabilityinWindowsSmartScreen.Whileotherpartsoftheattackchainfromthisactorchangedorvaried,.URLfileswereinvolvedineverycampaign.\r\n\r\nTheemailsinthiscampaigncontained:\r\n\r\n\r\n*404TDSURLsthat,ifclickedbytheuser,redirectedtoKeitaroTDS\r\n*KeitaroTDSwasobservedservinganinternetshortcut(.URL)file\r\n*Theinternetshortcut,ifdoubleclicked,downloadedazippedVBSscript\r\n*TheVBSinturndownloadedandexecutedseveralshellcommands(cmd.exe)\r\n*Theshellcommands(a)createdadirectoryonC:drive,(b)copiedcurl.exefromsystemfoldertothisnewdirectory,(c)usedthecurltodownloadAutoit3.exe,(d)usedcurltodownloadandsaveanAutoITscript,and(e)ranthedownloadedAutoITscriptwiththedownloadedAutoITinterpreter\r\n*TheAutoITscriptrananembeddedDarkGate\r\n\r\n*Attackchainsummarythatfollowstheflowof:Email>404TDS>KeitaroTDS>.URL>.VBS>Shellcommands>AutoIT/AutoITscript>DarkGate.*\r\n\r\n*ScreenshotofanexampleemailfromOctober2campaign.*\r\n\r\n*Screenshotofthe.URLfileinvolvedintheOctober2campaign.*\r\n\r\nProofpointhasidentifiedmultiplecybercriminalcampaignsexploitingCVE-2023-36025;however,theBattleRoyalclusterexploitedthisvulnerabilitymorethananyotheractorobservedinProofpointthreatdata.Notably,thisactivityclusterexploitedCVE-2023-36025beforeitwaspublishedbyMicrosoft.SmartScreenisasecurityfeaturethatisdesignedtopreventpeoplefromvisitingmaliciouswebsites.ThevulnerabilitycouldallowanactortobypasstheSmartScreendefensesifauserclickedonaspeciallycrafted.URLfileorahyperlinkpointingtoa.URLfile.Morespecifically,aSmartScreenalertwouldnotbetriggeredwhena.URLpointstoaSMBorWebDavshareasfile:// and the malicious payload is inside a ZIP file which is specified in the URL target. \r\n\r\n ### RogueRaticate (fake browser update campaign example)\r\n\r\n On October 19, 2023, an external researcher identified and publicly shared details of the RogueRaticate fake update activity cluster using an interesting obfuscation techniq
