01/10/2024
Malware Update: TA571 Deploys 1,300 Malware Variants on 1,000 Organizations Worldwide
In a recent attack, a threat actor named TA571 used DarkGate to try to infiltrate over 1,000 organizations worldwide.The attack spanned across 14,000 campaigns and contained more than 1,300 different malware variants.
Here is what you need to know about DarkGate:
• Attackers demand health and safety goods through phishing emails from known suppliers.
• Their emails contain unusual URL domains (receipt-May-22-05-2024) to bypass security.
• The attackers use a compromised traffic distribution system (TDS) to redirect URLs.
• The malicious link is received by users with a specific set of cookies in their browser.
• When and if the users download and execute the file, it activates keyloggers, data exfiltration tools, and ransomware.
DarkGate is stealthy, sophisticated, yet challenging to detect. So, based on what we have observed, you will need to analyze the sender, the sender's previous sending patterns, the sender and recipient's relationship based on previous communications, and the email payloads (files and embedded URLs).
Even if the URL changes over time, the phishing incident response system can detect unsafe info found in delivered emails.
