MALWARE FAMILY

DarkGate

Internal ID: win.darkgate

aliases

Last seen:Mar 17, 2026

Intelligence Profile

First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts. New versions of DarkGate have been advertised on a Russian language eCrime forum since May 2023.

Threat Analysis

DarkGate is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/

→https://blog.sekoia.io/darkgate-internals/

→https://blog.talosintelligence.com/darkgate-remote-template-injection/

→https://cloud.google.com/blog/topics/threat-intelligence/detecting-disrupting-malvertising-backdoors/

→https://cofense.com/blog/are-darkgate-and-pikabot-the-new-qakbot/

→https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-delivered-via-microsoft-teams-detection-and-response

→https://decoded.avast.io/janrubin/complex-obfuscation-meh/

→https://decoded.avast.io/janrubin/meh-2-2/

→https://dshield.org/diary/Guest+Diary+Dissecting+DarkGate+Modular+Malware+Delivery+and+Persistence+as+a+Service/30700/

→https://embee-research.ghost.io/decoding-a-simple-visual-basic-vbs-script-darkgate-loader/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.darkgate

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search DarkGate