Windows users in Europe have recently been the target of a sophisticated malware campaign that provides attackers with a diverse array of capabilities, including cryptomining, credential stealing, ransomware and remote-access takeovers.
Named DarkGate by its developer, the malware is reportedly distributed via Torrent files disguised as popular entertainment offerings — including the Spanish basketball dramedy
Campeones and the zombie drama
The Walking Dead. But these files actually execute malicious VBscripts on those who download them. Upon infection, the first malware’s interaction with the C2 server commences the mining process, but from there DarkGate has the potential to carry out additional attacks.
So far, the campaign has focused largely on users in Spain and France, according to a Nov. 13
blog post from endpoint security company enSilo, whose researcher Adi Zeligson discovered the threat on Dec. 27, 2017.
Researchers say that DarkGate appears to be closely related to a previously known password-stealer called Golroted.
