Ankura CTIX FLASH Update - March 15, 2024

Malware Activity

DarkGate Malware Campaign Exploits Microsoft Windows Defender SmartScreen Flaw

A DarkGate Malware campaign observed mid-January 2024 has been exploiting a Windows Defender SmartScreen flaw which is now patched in Microsoft's February Patch Tuesday release. The flaw – CVE-2024-21412 – allows certain files to bypass the security warning that SmartScreen is designed to display when unrecognized or suspicious files are detected. The flaw is exploited through a ".url" file that points to yet another ".url" file hosted on a remote SMB share which causes the file at the final location to be executed automatically. The malware campaign begins as most do – with a phishing email. The email contains a PDF document including links that utilize redirects from Google DoubleClick Digital Marketing services to evade email security checks. The link in the PDF file directs the victim to a compromised webserver which leads to the exploitation of the SmartScreen