APT / THREAT GROUP

DarkGate

aliases

Last seen:Mar 17, 2026

Intelligence Profile

First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts. New versions of DarkGate have been advertised on a Russian language eCrime forum since May 2023.

Threat Analysis

DarkGate is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/

→https://blog.sekoia.io/darkgate-internals/

→https://blog.talosintelligence.com/darkgate-remote-template-injection/

→https://cloud.google.com/blog/topics/threat-intelligence/detecting-disrupting-malvertising-backdoors/

→https://cofense.com/blog/are-darkgate-and-pikabot-the-new-qakbot/

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

MehCrypterwin.darkgateMehDarkGate

External Intelligence

Malpedia: win.darkgate

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search DarkGate