DarkGate: Opening Gates for Financially Motivated Threat Actors

Executive Summary 

EclecticIQ analysts observed that cybercriminals increased the delivery of the DarkGate loader following the FBI's takedown of Qakbot infrastructure in August 2023 [1]. EclecticIQ analysts assess with high confidence that financially motivated threat actors, including groups like TA577 and Ducktail, along with Ransomware-as-a-Service (RaaS) organizations such as BianLian and Black Basta, primarily use DarkGate. These threat actors target financial institutions in Europe and the USA, focusing mainly on double extortion tactics [2].  

Ransomware groups …

analysts as-a-service august bianlian cybercriminals darkgate delivery ducktail eclecticiq executive fbi high infrastructure loader malware analysis organizations qakbot raas ransomware service takedown threat threat actors