DarkGate switches up its tactics with new payload, email templates

Cisco Talos describes an active DarkGate malspam campaign (March 2024) that uses malicious Excel attachments with Remote Template Injection to pull remote VBS/PowerShell stages from attacker-controlled SMB/HTTP servers. The operators switched from AutoIT to AutoHotKey to load base64-encoded shellcode and execute the final DarkGate payload in-memory (avoiding disk writes), establish persistence via a startup shortcut, and target U.S. organizations—most frequently healthcare technologies and telecommunications—while Talos provides IOCs and detections for Cisco products.