Threat intelligence / Malware

DarkGate

[DarkGate](https://attack.mitre.org/software/S1111) first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, [DarkGate](https://attack.mitre.org/software/S1111) is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.(Citation: Ensilo Darkgate 2018) DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.(Citation: Trellix Darkgate 2023)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[DarkGate](https://attack.mitre.org/software/S1111) first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, [DarkGate](https://attack.mitre.org/software/S1111) is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.(Citation: Ensilo Darkgate 2018) DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.(Citation: Trellix Darkgate 2023)

Labels

malware

59 recorded

Relationships

uses

to Additional Local or Domain Groups

Technique

uses

to Application Window Discovery

Technique

uses

to AutoHotKey & AutoIT

Technique

uses

to Automated Collection

Technique

uses

to Bypass User Account Control

Technique

uses

to Clipboard Data

Technique

uses

to Compute Hijacking

Technique

uses

to Credentials from Password Stores

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Data from Local System

Technique

uses

to Data Obfuscation

Technique

uses

to Debugger Evasion

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Disk Content Wipe

Technique

uses

to DLL

Technique

uses

to DNS

Technique

uses

Technique

uses

to Double File Extension

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Financial Theft

Technique

uses

to Hidden Files and Directories

Technique

uses

to Hide Infrastructure

Technique

uses

to Hijack Execution Flow

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inhibit System Recovery

Technique

uses

Technique

uses

to Local Account

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious File

Technique

uses

to Masquerading

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Parent PID Spoofing

Technique

uses

to Path Interception by PATH Environment Variable

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Process Hollowing

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Rename Legitimate Utilities

Technique

uses

to Security Software Discovery

Technique

uses

to Service Execution

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Steal Web Session Cookie

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Location Discovery

Technique

uses

to System Shutdown/Reboot

Technique

uses

to System Time Discovery

Technique

uses

to Unsecured Credentials

Technique

uses

to Visual Basic

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

from Water Curupira Pikabot Distribution

Campaign

3 external

References

mitre-attack

S1111

Ensilo Darkgate 2018

https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign

Trellix Darkgate 2023

https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/