DarkGaboon

Executive Summary

DarkGaboon is a financially motivated APT that has been targeting Russian organizations since mid‑2023 primarily through spear‑phishing campaigns utilizing weaponized documents and malicious archives. The group employs a sophisticated blend of remote access trojans, custom backdoors, and ransomware (LockBit 3.0, Babuk) while leveraging advanced evasion techniques such as homograph file names, dynamic DNS C2 domains, and in‑memory PowerShell loaders. DarkGaboon’s operations demonstrate disciplined tool updates and strong operational security practices, making it a significant threat to critical national infrastructure sectors.

Goals & Targeting

DarkGaboon concentrates on high‑value targets across a broad geostrategic spectrum, prioritizing Russian and allied entities in finance, defense, government, energy, transportation, manufacturing, telecommunications, critical infrastructure, healthcare, and technology. Its operational tempo is sustained with periodic refreshes of its toolset—over 360 unique binaries have been catalogued—and it consistently demonstrates an ability to pivot across industries by exploiting legacy vulnerabilities (e.g., CVE‑2024‑11182 in MDaemon) and leveraging stolen credentials for lateral movement via RDP, SSH, or VPN connections.

Key Capabilities

• spear phishing attacks
• use of legitimate software in execution
• deployment of remote access trojans
• data theft and destruction
• encryption of victim infrastructure using LockBit 3.0 ransomware
• use of fake X.509 certificates and homoglyph file names to masquerade malware
• deployment of double‑extension files (e.g., .pdf.scr, .xlsx.scr) with disguised icons
• protection of binaries with Themida and .NET Reactor
• obfuscated .NET megadropper that extracts multiple payloads
• dynamic DNS domains organized in two non‑overlapping clusters
• phishing attachments delivering backdoors such as DarkGate, BrockenDoor, and Remcos
• living‑off‑the‑Land tactics via PowerShell and WMI
• persistence through creation of scheduled tasks on Windows
• privilege escalation using compromised employee accounts and remote protocols (RDP, SSH, VPN)
• backup destruction with the SDelete utility
• deployment of Babuk ransomware for data encryption and ransom demands
• exploitation of CVE‑2024‑11182 XSS vulnerability in MDaemon Email Server
• Microsoft Office CVE‑2012‑0158 exploitation
• Ivanti EPMM CVE‑2025‑44277/88 exploitation
• phishing emails with malicious archive payloads (ZIP containing LNK and HTA loaders)
• weaponized DOCX files exploiting legacy CVEs CVE-2017-0199 and CVE-2017-11882
• obfuscated PowerShell loader that decrypts shellcode in memory before execution
• deployment of Cobalt Strike beacons using a custom malleable profile for C2 evasion
• multiple infection chains and decoys targeting finance/legal departments

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

DarkGaboon’s operations exhibit a pattern of regular penetration attempts across a diversified industry portfolio, with a clear focus on Russian entities but extending to other strategic regions such as the US, China, Ukraine, and the Middle East. The actor routinely updates its toolchain, maintaining a library of more than 360 distinct binaries that are introduced through polished spear‑phishing campaigns. Notably, DarkGaboon has escalated from data exfiltration to ransomware deployment (LockBit 3.0, Babuk), consistently targeting financial and critical infrastructure sectors while employing defensive evasion techniques, such as dynamic DNS C2 clusters and homograph file names, to avoid detection.

IOC Patterns

• fake X.509 certificates
• homoglyph usage in executable names
• email subjects and attachment titles with deceptive formatting
• double extensions (.pdf.scr) in malicious files
• icons mimicking MS Office or PDF for hidden malware
• dynamic DNS domain clusters for command and control
• spear‑phishing attachments dropping backdoors
• WebDAV exploitation of CVE-2025-33053
• stolen credentials accessing SSL VPN systems
• publicly accessible web shells on victim servers
• backdoors such as MeshCentral Agent and SystemBC installed
• Biotime vulnerabilities CVE‑2023‑38950/51/52 for re-entry
• spear‑phishing links via malicious URLs
• ZIP archives containing LNK and HTA loaders
• weaponized DOCX files exploiting CVE-2017-0199/CVE-2017-11882
• obfuscated PowerShell scripts that decrypt shellcode in memory
• custom Cobalt Strike malleable profile for C2 communication

Recommended Actions

• Patch MDaemon Email Server to mitigate CVE‑2024‑11182 and update Ivanti EPMM for CVE‑2025‑44277/88. Apply all available security updates promptly.
• Monitor dynamic DNS activity and block suspicious domain clusters using reputation services.
• Implement file policy to detect and block double‑extension files or homoglyph filenames; enforce strict attachment handling controls.
• Strengthen user awareness training against spear‑phishing; adopt DMARC, SPF, and DKIM email authentication mechanisms.
• Configure endpoint detection to flag known backdoor families such as DarkGate, Remcos, BrockenDoor, and ransomware variants LockBit 3.0 and Babuk.
• Enable logging and continuous monitoring of scheduled tasks to detect unauthorized persistence mechanisms.
• Enforce multi‑factor authentication and least privilege on all user accounts; restrict remote service access (RDP/SSH/VPN) to approved devices only.
• Protect backups by using immutable or off‑network storage, regularly audit integrity, and ensure backup copies are stored separately from production networks.
• Patch CVE‑2025‑33053 as soon as possible; apply patches for CVEs‑2023‑38950/51/52.
• Enforce multi‑factor authentication for VPN and critical systems.
• Detect and remove unauthorized web shells and backdoor binaries.
• Maintain regular vulnerability scanning and patch management.
• Deploy email filtering and attachment sandboxing to block malicious archives and weaponized documents.
• Apply security patches to address CVE‑2017‑0199 (Drupal) and CVE‑2017‑11882 (Office).
• Detect and block obfuscated PowerShell activity using EDR solutions.
• Monitor network traffic for Cobalt Strike beacon patterns, especially custom malleable profiles.

Suggested Tags