Cloud Threats Memo: Back to the Basics: New DarkGate Campaign Exploiting Microsoft Teams

DarkGate is a commodity malware with multiple features including the ability to download and execute files to memory, a hidden virtual network computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. This malware has been delivered in multiple campaigns over the past few months since at least September 2023, and one of the common characteristics of these campaigns has been the continual exploitation of legitimate cloud services, such as Microsoft Teams, Skype, Google Drive, or Dropbox, to deliver the malicious payload.

However, it looks like the threat actors are back to the basics, since security researchers at AT&T Cybersecurity have uncovered a new campaign abusing Microsoft Teams to deliver the malicious payload. In particular, threat actors exploited external group chat requests (External Access is enabled by default on Microsoft Teams) to distribute malicious attachments installing the DarkGate malware payloads on victims’ systems. Even more interesting, the attackers used a compromised Teams user (or domain) to send more than 1,000 malicious Teams group chat invites containing the malicious payload as a double-extension Microsoft Installer file, disguised as a pdf.

This campaign is a perfect example why legitimate cloud services are so attractive for cyber criminals: on one hand, a compromised cloud service provides the attackers with multiple additional tools to make their campaign more evasive and successful (in this case the attackers exploited the Microsoft Teams chat of a compromised tenant,) on the other hand it is much easier to conceal a malicious payload into a legitimate traffic where too often organizations do not enforce the same security controls applied to traditional web traffic. It is no coincidence that Microsoft SharePoint (the cloud storage app used by Microsoft Teams) is one of the most exploited cloud services for malware downloads (together with another well-known Microsoft application).

Mitigating the Risks of Malware Delivered from Legitimate Cloud Services

Of course the first recommendation would be to disable external access from Microsoft Teams, however if this is not possible for the organization, this app (and its storage counterpart SharePoint) is one of the thousands of cloud services where the Netskope Next Gen SWG can provide adaptive access control, threat protection, and Data Loss Prevention. They are also among the hundreds of apps for which instance detection is available. So, in cases where these services are exploited to deliver a malicious payload, it is possible to configure a policy for preventing potentially dangerous activities (such as “Upload” and “Download”) from non-corporate instances of SharePoint only.

Netskope customers are also protected against malware distributed from similar legitimate cloud services (and the web in general) by Netskope Threat Protection. Netskope Threat Protection scans web and cloud traffic to detect known and unknown threats with a comprehensive set of engines, including signature-based AV, machine learning detectors for executables and Office documents, and sandboxing with patient zero protection. Netskope threat intelligence can also detect command and control connections even if they are directed to a legitimate cloud service. The threat protection capabilities can be augmented through Netskope Cloud Exchange, which provides powerful integration tools to leverage investments across users’ security posture through integration with third-party tools, such as threat intelligence feeds, endpoint protection and email protection technologies.

The risk of a compromised tenant can be mitigated proactively through Netskope SaaS Security Posture Management (SSPM,) which continuously monitors and enforces SaaS security settings, policies, and best practices to reduce security and compliance risks and possible misconfigurations that can be exploited by the attackers to compromise the tenant. While the Netskope Behavior Analytics allows to detect anomalies such as activities by compromised accounts in the corporate tenant, reducing the risk of malicious exploitation by the attackers.

Finally, Netskope Advanced Analytics provides specific dashboards to assess the risk of rogue cloud instances being exploited to deliver malware or the risk of becoming the target of anomalous communications, with rich details and insights, supporting security teams in the analysis and mitigation/remediation process.

Stay safe!