What is DarkGate malware?

DarkGate is a sophisticated malware loader and remote access trojan sold as a premium Malware-as-a-Service offering. It gained prominence after the QakBot takedown as threat actors migrated to DarkGate for initial access operations. It features credential theft, keylogging, cryptocurrency mining, and remote desktop capabilities.

DarkGate Loader

DarkGate Loader (also known as DarkGate) is a malware loader active since 2017. Premium MaaS loader. Key characteristics include: hVNC, crypto mining, keylogger, RDP hijacking, $15K/month limited seats, QakBot replacement.

Overview & Background

Premium MaaS loader. First identified in 2017, this threat is attributed to eCrime (MaaS).

Threat Assessment

DarkGate Loader remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this malware loader.

Category: Malware Loader
Active since: 2017
Attribution: eCrime (MaaS)
Also known as: DarkGate

Technical Analysis

DarkGate Loader employs the following capabilities and techniques:

Hvnc: Core functionality
Crypto Mining: Core functionality
Keylogger: Core functionality
Rdp Hijacking: Core functionality
$15K/Month Limited Seats: Core functionality
Qakbot Replacement: Core functionality

MITRE ATT&CK Mapping

Tactic	Technique	Usage
Initial Access	T1566.001 Phishing Attachment	Common delivery vector
Execution	T1204.002 Malicious File	User-triggered execution
Persistence	T1547.001 Registry Run Keys	Autostart persistence
Defense Evasion	T1027 Obfuscated Files	Payload obfuscation
C2	T1071.001 Web Protocols	HTTP/HTTPS C2

Detection & Defense

Endpoint detection: Deploy behavioral detection rules for DarkGate Loader indicators
Network monitoring: Monitor for C2 traffic patterns and anomalous connections
Threat intelligence: Track DarkGate Loader IOCs and campaign updates
Security awareness: Train users to recognize phishing and social engineering
Patch management: Keep systems updated to prevent exploitation

Defend Against DarkGate Loader

Mjolnir Security provides detection and response capabilities against DarkGate Loader and similar threats.

Threat DetectionIncident ResponseThreat HuntingMDR ServicesThreat Intelligence

Proactive Threat Hunting Hunt for DarkGate Loader indicators and TTPs within your environment.
Threat Intelligence Monitor DarkGate Loader campaigns and infrastructure changes.
24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 4, 2025

Overview & Background

Technical Analysis

MITRE ATT&CK Mapping

Detection & Defense

Defend Against DarkGate Loader

Latrodectus: IcedID Successor

SystemBC: Ransomware Enabler