BattleRoyal Cluster Signals DarkGate Surge
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-36025 | Windows SmartScreen Bypass (CVE-2023-36025) Exploited via Crafted Shortcut Files CVE-2023-36025 is a security feature bypass in Windows SmartScreen in which a specially crafted file — exploited in the wild using Internet Shortcut (.url) files — evades the Mark-of-the-Web warning SmartScreen normally displays for content downloaded from the internet. The flaw is network-reachable and requires no authentication, but user interaction is required: it triggers when a user clicks the crafted file delivered via phishing email, chat, or a web download. By bypassing the SmartScreen prompt, the attacker removes a key user-facing defense that would otherwise flag or warn about the file, which facilitated delivery of malware in the observed DarkGate and Mispadu campaigns. Any unpatched Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), or Windows Server 2008/2012/2016/2019 system is affected, which at the time of disclosure effectively meant the entire supported Windows installed base. It is confirmed exploited in the wild: CISA added it to the KEV catalog on 2023-11-14, EPSS scores 30-day exploitation probability at 88.1% (100th percentile), though no public PoC is known. Do: Apply Microsoft's November 2023 cumulative Windows security updates (the release containing the fix) on all affected Windows 10/11 and Windows Server systems; no configuration-based workaround is widely documented, so patching is the primary mitigation. Until patched, treat unexpected Internet Shortcut (.url) files arriving via email or chat with extra suspicion, since they can execute without the usual SmartScreen warning, and hunt for DarkGate/Mispadu indicators. Given the KEV listing and 88.1% EPSS, prioritize this fix in the current patch cycle; ransomware-associated use is reported as unknown. | 8.8 | 88% | KEV |
| mass>1 billion endpoints (effectively the entire supported Windows 10/11/Server installed base at the time of disclosure) |
Full article363 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers have warned against the DarkGate threat actor, who has recently gained notoriety in the realm of remote access Trojans (RATs) and loaders.
Earlier today, Proofpoint confirmed it has been tracking a distinct operator of the DarkGate malware, temporarily named BattleRoyal, noting its use in at least 20 email campaigns from September to November 2023.
These campaigns were characterized by their diverse delivery methods, including emails, Microsoft Teams, Skype, malvertising and fake updates.
The BattleRoyal cluster demonstrated a significant focus on exploiting a specific vulnerability, CVE-2023-36025, which affects Windows SmartScreen, a security feature designed to thwart visits to malicious websites.
Notably, BattleRoyal exploited this vulnerability before it was publicly disclosed by Microsoft. The modus operandi involved using various attack tools, such as 404 TDS, Keitaro TDS and URL files, with the latter exploiting the Windows vulnerability mentioned above.
Proofpoint identified multiple campaigns exploiting CVE-2023-36025, but BattleRoyal stood out for its frequency in leveraging this vulnerability. The malware delivery mechanisms included email campaigns and a RogueRaticate fake browser update.
The latter, discovered on October 19 2023, used an obfuscation technique that concealed DarkGate payloads with the “ADS5” GroupID. The actors injected requests to controlled domains, utilizing .css steganography to hide malicious code.
Read more on DarkGate: DarkGate Malware Campaigns Linked to Vietnam-Based Cybercriminals
In a notable evolution, the BattleRoyal cluster transitioned from DarkGate to NetSupport, a well-established remote access tool, in late November to early December. This change could be attributed to a rise in DarkGate’s popularity or a strategic shift. The campaigns exhibited a gradual evolution, employing two .URL files instead of one.
According to Proofpoint, the BattleRoyal cluster’s use of multiple attack chains highlights a new trend among cybercriminals.
“The actor’s use of both email and compromised websites with fake update lures to deliver DarkGate and NetSupport is unique but aligns with the overall trend Proofpoint has observed of cyber criminal threat actors adopting new, varied, and increasingly creative attack chains [...] to enable malware delivery,” reads the advisory.
“Additionally, the use of both email and fake update lures shows the actor using multiple types of social engineering techniques in an attempt to get users to install the final payload.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/battleroyal-cluster-signals/