Tuesday, April 16, 2024

Hackers Using Microsoft Teams to Deliver DarkGate Malware Via HR-themed Messages

Recent reports indicate that threat actors have been using Microsoft Teams to deliver DarkGate Loader malware.

The campaign originated from two compromised external Office 365 accounts identified to be “Akkaravit Tattamanas” ([email protected]) and “ABNER DAVID RIVERA ROJAS” ([email protected])

DarkGate loader malware was introduced in 2017 but was only being used by its original developer. However, in June 2023, the malware developer started to advertise it on several cybercrime forums as Malware-as-a-service (MaaS).

It was traditionally spread via email until one of the operators had other ideas and started to use Microsoft Teams to deliver the malware. The message context sent to the victims consisted of an HR-themed social engineering chat message.

Hackers Using Microsoft Teams

Further investigations revealed that the chat messages consisted of an externally hosted Sharepoint link, which contains a ZIP file under the name “Changes to the vacation schedule.zip.”

Phishing message on Microsoft Teams (Source: Truesec)

Once the victims download this ZIP file, it consists of an LNK file (shortcut) disguised as a PDF document and has the name “Changes to the vacation schedule.pdf.lnk”.

LNK file (shortcut) disguised as a PDF file

Further analysis of the LNK file revealed that if opened, the file has several commands for a chain of execution, which will initially create a VBScript file with the name “asrxmp.vbs” in the C:\tpgh\ directory and execute it automatically.

Once the VBScript file gets executed, it downloads the file from the remote server hXXp:// 5[.]188[.]87[.]58:2351/wbzadczl and executes it. This execution leads to the use of the Windows version of cURL (renamed to wbza) for downloading and executing Autoit3.exe and the bundled script eszexz.au3. 

This AutoIT script drops another shellcode file and checks if Sophos is installed before executing it. If not, the AutoIT script deobfuscates its code further and launches the shellcode.

This final shellcode execution creates a file byte to byte to load a new Windows executable identified as the “DarkGate loader” malware.

A complete report has been published by Truesec, which provides detailed information about the deobfuscation, configuration analysis, and other information about this DarkGate loader malware.

“Unfortunately, current Microsoft Teams security features such as Safe Attachments or Safe Links were not able to detect or block this attack.” reads the post by Truesec. This campaign was detected due to the security awareness training of the recipients.

Organizations and IT administrators are recommended to implement some security features, including allowing Microsoft Teams chat requests from specific external domains and creating a whitelist of trusted domains.

It is also recommended that organizations train their employees in cyber security awareness, which can educate all the employees and prevent future attacks.

Indicators of Compromise

FilenameSHA256 Hash
Changes to the vacation schedule.zip0c59f568da43731e3212b6461978e960644be386212cc448a715dbf3f489d758
Changes to the vacation schedule.pdf.lnkbcd449470626f4f34a15be00812f850c5e032723e35776fb4b9be6c7be6c8913

Command & Control Server

  • hXXp://5[.]188[.]87[.]58:2351

Compromised Email Addresses

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles