DarkGate malware

DarkGate is a loader with remote access trojan (RAT) capabilities, written in Delphi with modules in C++, and sold to cybercriminals as malware-as-a-service (MaaS). Its job is to get onto a machine, stay there, and give its operator control: it can download and run further payloads, open a remote shell, log keystrokes, steal credentials, and provide hidden remote desktop access. First seen in 2018, with its developer claiming work began in 2017, DarkGate gained real prominence in the second half of 2023 and remains in active use and active development. MITRE ATT&CK catalogs it as S1111. What makes DarkGate matter to defenders isn't any single capability. It's the combination of a broad feature set, an unusual amount of effort spent on evading antivirus products, and a rental model that puts all of it in the hands of whoever pays. A DarkGate infection is rarely the end of an intrusion. It's usually the beginning. This page covers how DarkGate is sold, how it reaches a machine, what it can do, how it hides, who uses it, and how organizations detect it, drawing in part on first-party research by Sekoia's Threat Detection & Research (TDR) team.

Key takeaways

DarkGate is a loader with RAT capabilities. It delivers further malware and gives its operator hands-on control of the compromised machine.
It's rented, not owned. DarkGate is sold as malware-as-a-service to a deliberately small number of subscribers, which means many unrelated actors use the same tool.
Evasion is its selling point. Custom obfuscation, abuse of legitimate Windows binaries, and checks for analysis environments are central to the product rather than afterthoughts.
It arrives through phishing and deception. Email links, stolen message threads, chat platform messages, malicious advertising, and fake installers are its usual routes in.
Treat it as a precursor. Because it exists to deliver other payloads, a DarkGate detection should be handled as a possible early stage of a ransomware or data theft operation.

How DarkGate is sold

DarkGate is a commercial product in the cybercrime economy. It's offered on underground forums by a single persona known as RastaFarEye, on a subscription basis, and the seller has deliberately kept the customer base small: reporting describes an initial cap of around ten subscribers, later raised to roughly thirty as demand grew, at a price reported to reach about 15,000 US dollars per month. That's expensive for commodity malware, and the seller has justified it by pointing to years of continuous development.

The small customer base has a practical consequence for defenders. Because only a few dozen operators have access, DarkGate activity clusters into a manageable number of campaigns, but those operators are often experienced and well-resourced. The model has also proved resilient. The seller was banned from at least one major forum at the end of 2023 after customer complaints, yet development and distribution continued afterward, with successive major versions released and reports of the seller operating under other names. Each version has been advertised on the strength of breaking the detection published by security researchers, which tells you what the product is really competing on.

How DarkGate reaches a machine

DarkGate's operators rely on deception rather than exploitation. The specific lure changes constantly, but the routes in fall into a few families.

DarkGate delivery routes
Delivery route	How it works
Phishing emails with links	The most common route. A message carries a link rather than an attachment, leading to an installer or script file. Campaigns have hijacked stolen email threads so the message arrives inside a conversation the recipient recognizes.
Chat and collaboration platforms	Messages sent through workplace chat tools, which many organizations filter less carefully than email and which carry an implicit trust that email has lost.
Malicious advertising and search results	Paid advertising and manipulated search rankings place a fake download page above the legitimate one for popular software.
Fake installers and updaters	The payload masquerades as a legitimate application installer or software update, so the user grants it the permissions it needs.
Scripted first stages	Whatever lure is used, the chain typically runs through a script or installer file that fetches and launches the loader, often using a legitimate scripting runtime to do so.

None of this requires a vulnerability. The user is the mechanism, which is why DarkGate reaches fully patched machines and why awareness and email controls matter as much as endpoint hardening.

What DarkGate can do

DarkGate is closer to a toolkit than a single-purpose tool. Its operator chooses which capabilities to enable, and the set has grown with each version.

DarkGate capabilities
Capability	What it means in practice
Payload delivery	Downloads and runs additional malware, which is its core purpose as a loader and the reason a DarkGate alert matters beyond itself.
Interactive remote shell	Gives the operator a command prompt on the machine, so they can explore, run commands, and act as though sitting at the keyboard.
Script execution	Runs scripts fetched from the operator's server, which is how much of the post-compromise activity is carried out.
Credential and data theft	Harvests credentials and information from browsers and applications, including session tokens for chat platforms.
Keylogging	Records keystrokes, capturing anything typed, including passwords entered outside a browser.
Hidden remote desktop	Provides graphical remote access through a concealed desktop session, and can install or repurpose legitimate remote access software to do it.
Cryptomining	Uses the machine's processing power to mine cryptocurrency, a low-effort way to monetize an infection.
Privilege escalation and persistence	Raises its own privileges and reinstalls itself after a reboot through several configurable mechanisms.

How DarkGate avoids detection

Evasion is where DarkGate has invested most, and it's the reason the malware kept working while it was being publicly analyzed. At a level useful to defenders rather than to attackers, its techniques fall into four groups.

Obfuscated code and configuration. The malware encodes its settings, its command and control addresses, and the text inside it using custom schemes, so scanning for recognizable strings finds nothing. Its network traffic is obfuscated in the same spirit.
Working around security product hooks. Rather than calling Windows functions the way security software expects to observe them, DarkGate resolves and invokes them indirectly, which removes many of the vantage points antivirus products rely on.
Borrowing legitimacy from Windows itself. The loader abuses signed Windows binaries to load its own code, injects into other processes, and misrepresents which process launched it, defeating detection rules built around parent and child process relationships.
Checking where it's running. Before doing anything noisy, it inspects the machine for signs of a virtual or analysis environment, such as implausible hardware characteristics, and looks for installed security software. It also reacts to interference: if its persistence is stripped out, it can deliberately crash the machine.

Not everything about DarkGate is original. Sekoia's analysis found that several of its techniques come from proof-of-concept code published openly by researchers, and that for some functions, such as remote access and credential theft, it uses well-known legitimate utilities that security products already detect. The assessment is worth holding onto: this is a capable development effort, but it's an assembly of known parts, and that's precisely what makes behavioral detection effective against it.

Who uses DarkGate

Because DarkGate is rented, there's no single group behind its use. Named cybercriminal operations that have deployed it include the access broker tracked as TA577 and the operation known as Ducktail, alongside other clusters identified only by tracking designations. Leaked internal communications from a major ransomware operation also showed the group buying access to DarkGate for its campaigns and dealing directly with the developer for support.

That last point is the one to remember. DarkGate rose to prominence in late 2023, in a period when law enforcement had disrupted one of the largest loader botnets and criminal operators were looking for replacements. Loaders occupy a specific place in the criminal supply chain: they're the product that initial access brokers use, and the thing that ransomware affiliates buy access from. When DarkGate lands on a machine, the meaningful question isn't what it does on its own, but who's going to be sold that foothold next.

Sekoia's research on DarkGate

Sekoia's TDR team published a detailed technical analysis of DarkGate in November 2023, reverse engineering the loader through its stages to document how it obfuscates its configuration and its traffic, how it escalates privileges and persists, and the specific evasion techniques it uses. The analysis mapped the malware's behavior to the MITRE ATT&CK framework and set out what it leaves behind on an infected machine, which is what turns a technical write-up into something a hunting team can act on.

Alongside the analysis, Sekoia released practical tooling to the community, including a script to deobfuscate DarkGate's command and control traffic and documentation of the instruction codes its operators use. The team's conclusion was measured rather than dramatic: the people behind DarkGate have real development skill, but they also lean on publicly available techniques and on legitimate tools that defenders can already see, and the malware's breadth of technique is what makes it distinctive rather than any single unbeatable trick. That assessment holds up, and it's the basis for detecting it.

How to detect and defend against DarkGate

Because DarkGate changes its appearance constantly but not its behavior, defense works better when it targets what the malware does rather than what it looks like:

Filter and inspect links, not just attachments. Since campaigns lead with links, including inside hijacked email threads, link inspection and user awareness of thread-reply lures close the main route in.
Extend controls to chat platforms. Apply the same scrutiny to messages arriving through collaboration tools as to email, since these channels are commonly less monitored.
Watch for scripting runtimes behaving oddly. A legitimate scripting engine launching from an unusual location, or running shortly after a browser or mail client, is a strong signal worth alerting on.
Alert on the evasion behaviors. Unexpected process injection, mismatched parent and child processes, and signed Windows utilities loading unusual libraries are all detectable, and all central to how DarkGate operates.
Hunt for the traces it leaves. The malware writes files and registry entries during normal operation, and documented artifacts of that activity give hunting teams concrete things to look for after the fact.
Treat a detection as an intrusion, not an incident closed. Assume something was delivered. Investigate what followed the loader rather than removing it and moving on.

Why rented malware needs behavior-based detection

DarkGate illustrates something that has changed about commodity malware. A subscription product competes on features, and the feature its customers care about most is not getting caught. So the developer reads the analyses that security vendors publish and ships updates specifically to break the detection in them. Every new version arrives having already been tested against what the industry knows. Detection built on recognizing files is structurally on the losing side of that cycle, always describing the version before the current one.

What doesn't change at the same pace is behavior. A loader still has to run, still has to persist, still has to reach its operator's server, and still has to launch whatever it was paid to deliver. That's the layer Sekoia builds on. Sekoia is a European cybersecurity vendor whose in-house TDR team has reverse engineered DarkGate directly and published both the analysis and working tooling from it, and that research feeds the Sekoia AI SOC platform. Signals from endpoint, network, and email sources are correlated and matched against rules mapped to the MITRE ATT&CK framework, so the shape of an infection, a script running where one shouldn't, a process misrepresenting its parent, an obfuscated callback to an unfamiliar server, is recognized as one chain of activity even when the specific sample has never been seen before.

The practical takeaway is to judge a loader by what it opens the door to. A DarkGate alert is worth treating as the visible part of a longer operation, because the business model behind it exists to sell that access to someone else. Detecting the loader is useful. Understanding what came after it is what prevents the incident that follows.