DarkGate Malware Abusing Cloud Storage & SEO Following Delivery Over Teams

DarkGate is a commercially available malware-as-a-service used by financially motivated actors and ransomware groups to compromise financial institutions across the US and Europe; the report describes active distribution via phishing and abused web services (e.g., DoubleClick), delivery evolutions (CAB/MSI, DLL side-loading), evasion techniques (custom crypter, polymorphism, anti-VM, rootkit), and associated IOCs and detection strategies.