Malware Roundup: Countering DarkGate Loader and Rhysida Ransomware Tactics

Introduction

The latest Security Affairs Malicious Software Newsletter (Round 103) highlights a concerning trend: the continued evolution of "Loader-as-a-Service" families, specifically DarkGate, alongside the persistent threat of Rhysida ransomware. For defenders, this is not just news—it is an actionable intelligence brief. While vulnerabilities grab headlines, it is often these malware families that provide the initial access or final payload in modern intrusion chains.

This post breaks down the technical mechanics of these threats as reported in Round 103 and provides the detection logic and hardening steps necessary to stop them in your environment.

Technical Analysis

1. DarkGate Loader (v4/v5 Evolution)

DarkGate remains a premier payload delivery mechanism due to its sophisticated evasion techniques. Recent campaigns analyzed in this newsletter showcase a shift toward abusing legitimate collaboration tools and social engineering to bypass perimeter defenses.

Attack Vector: Phishing emails containing malicious attachments (HTML smuggling, ISO files) or links leading to fake software downloads.
Mechanism: DarkGate is a VB6-based downloader. Upon execution, it often establishes a C2 channel and uses PowerShell to download additional payloads (info-stealers, ransomware).
Evasion: Heavy use of process hollowing and legitimate system utilities ("Living off the Land") to blend in with normal traffic.

2. Rhysida Ransomware

Rhysida continues to target high-value sectors, including healthcare and manufacturing. The group operates with a "double-extortion" model, encrypting systems and exfiltrating data for leverage.

Attack Vector: Frequently delivered via initial access brokers (often utilizing loaders like DarkGate or Cobalt Strike beacons).
Mechanism: Once established, Rhysida deploys a custom encryptor. A critical TTP observed in recent intrusions is the use of rclone—a legitimate command-line cloud sync tool—for data exfiltration prior to encryption.
Impact: Rapid encryption of critical files; exfiltration of sensitive PII/PHI posted on their leak site if ransoms aren't paid.

Detection & Response

Sigma Rules

The following rules target the specific execution chains associated with DarkGate and the exfiltration techniques used by Rhysida.

YAML

---
title: Potential DarkGate Loader Activity via PowerShell
description: Detects suspicious PowerShell execution patterns often associated with DarkGate loader downloads and C2 initialization.
references:
  - https://securityaffairs.com/194383/malware/security-affairs-malware-newsletter-round-103.html
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - '-Enc'
      - 'DownloadString'
    CommandLine|contains:
      - 'http://'
      - 'https://'
  condition: selection
falsepositives:
  - Legitimate system administration scripts
level: high
---
title: Rclone Usage for Potential Data Exfiltration
description: Detects the use of rclone, a legitimate tool often abused by ransomware actors like Rhysida to exfiltrate data to cloud storage.
references:
  - https://securityaffairs.com/194383/malware/security-affairs-malware-newsletter-round-103.html
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
  filter_legit:
    ParentImage|contains:
      - '\Program Files\'
      - '\ProgramData\'
  condition: selection and not filter_legit
falsepositives:
  - Authorized backup operations using rclone
level: critical

KQL (Microsoft Sentinel / Defender)

Use this KQL query to hunt for processes initiating network connections that are characteristic of DarkGate C2 behavior or generic webshells.

KQL — Microsoft Sentinel / Defender

// Hunt for PowerShell processes with network connections (DarkGate/Loader activity)
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
| where RemotePort in (80, 443, 8080) 
| where InitiatingProcessCommandLine contains_any ("-Enc", "-EncodedCommand", "DownloadString", "IEX")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| sort by Timestamp desc

Velociraptor VQL

This artifact hunts for the presence of rclone and suspicious scheduled tasks often set by loaders to maintain persistence.

VQL — Velociraptor

-- Hunt for Rclone and Suspicious Scheduled Tasks
SELECT 
  OSPath, 
  Size, 
  Mtime 
FROM glob(globs="C:\Users\*\Downloads\rclone.exe")

SELECT 
  TaskName, 
  Author, 
  Trigger, 
  Action 
FROM scheduler_tasks()
WHERE Action =~ ".exe" 
   AND Author != "Microsoft" 
   AND TaskName =~ "Update" OR TaskName =~ "System"

Remediation Script (PowerShell)

This script scans for common DarkGate/Rhysida artifacts and malicious scheduled tasks. Run with elevated privileges.

PowerShell

# Security Arsenal - Malware Round 103 Remediation Script
# Scans for rclone.exe in user profiles and suspicious scheduled tasks.

Write-Host "[+] Starting scan for DarkGate/Rhysida artifacts..." -ForegroundColor Cyan

# 1. Check for rclone.exe in user profiles (common exfil tool location)
$rcloneFound = $false
$profiles = Get-ChildItem "C:\Users\" -Directory -ErrorAction SilentlyContinue

foreach ($profile in $profiles) {
    $path = Join-Path -Path $profile.FullName -ChildPath "Downloads\rclone.exe"
    if (Test-Path $path) {
        Write-Host "[!] ALERT: Found rclone.exe at $path" -ForegroundColor Red
        $rcloneFound = $true
        # Optional: Remove-Item -Path $path -Force
    }
}

if (-not $rcloneFound) {
    Write-Host "[-] No rclone.exe found in user download folders." -ForegroundColor Green
}

# 2. Audit Suspicious Scheduled Tasks (Non-Microsoft)
Write-Host "[+] Checking for non-Microsoft scheduled tasks..."
$suspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.Author -notlike "*Microsoft*" -and 
    $_.TaskName -notlike "*Microsoft*" -and
    $_.State -eq "Ready"
}

if ($suspiciousTasks) {
    Write-Host "[!] ALERT: Found potentially suspicious scheduled tasks:" -ForegroundColor Red
    $suspiciousTasks | Format-Table TaskName, Author, State -AutoSize
} else {
    Write-Host "[-] No obvious suspicious scheduled tasks found." -ForegroundColor Green
}

Write-Host "[+] Scan complete. Review alerts and investigate artifacts." -ForegroundColor Cyan

Remediation

To effectively defend against the threats outlined in Round 103, implement the following controls immediately:

Application Control: Implement strict allow-listing (AppLocker or Windows Defender Application Control) to prevent the execution of unsigned binaries like rclone.exe and unauthorized PowerShell scripts in user directories.
Network Segmentation: Block outbound traffic to known DarkGate C2 infrastructure and restrict access to personal cloud storage endpoints (e.g., Mega.nz, Dropbox personal APIs) from critical servers, as these are common exfil destinations for Rhysida.
User Awareness: Retrain staff on identifying sophisticated phishing campaigns, specifically those distributing "ISO" files or prompting for "Teams" updates outside of standard corporate channels.
Patch Management: Ensure all systems are updated against the latest Microsoft Exchange and Windows vulnerabilities, as these are frequent entry points for the initial access brokers that deploy these malware families.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub