{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/darkgate/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["DarkGate"],"_cs_cpes":["cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eDarkGate malware, identified in multiple campaigns, performs modifications to the Windows Error Reporting (WER) registry configuration as a defensive evasion tactic. Specifically, it targets the 'DontShowUI' registry value within the 'SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting' path, setting the value to '0x00000001'. By performing this modification, the malware suppresses Windows error reporting dialogs that would typically trigger if a process crashes during the execution of malicious payloads. This behavior is a key indicator of stealth-oriented malware installation, as it prevents alerting the user or system administrators to abnormal application behavior during the initial deployment phase. Defenders should monitor for registry modifications to this path to identify processes attempting to evade standard OS-level error notifications.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial delivery or execution of the DarkGate malware binary.\u003c/li\u003e\n\u003cli\u003eMalware checks environment for specific security software or sandbox artifacts.\u003c/li\u003e\n\u003cli\u003eMalware initiates persistence and installation routines on the victim host.\u003c/li\u003e\n\u003cli\u003eMalware accesses the registry path 'HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting'.\u003c/li\u003e\n\u003cli\u003eMalware performs a write operation to set the 'DontShowUI' value to '0x00000001'.\u003c/li\u003e\n\u003cli\u003eMalware proceeds with main malicious payload execution, such as C2 communication or data exfiltration.\u003c/li\u003e\n\u003cli\u003eIf a crash occurs during execution, the OS suppresses the error notification, preventing user discovery.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe suppression of WER dialogs allows the DarkGate malware to operate without generating user-visible alerts, which increases the likelihood of a successful, undetected installation. This technique is designed to bypass basic user awareness and diagnostic telemetry that might otherwise highlight the presence of malicious software during its setup phase. Failure to detect this activity leaves the environment susceptible to the full functionality of the DarkGate payload, which includes remote access capabilities and credential theft.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect unauthorized modifications to the 'DontShowUI' registry value via Sysmon Event ID 13.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for 'SetRegistryValue' actions targeting the 'Windows Error Reporting' hive.\u003c/li\u003e\n\u003cli\u003eValidate internal configurations to ensure that registry monitoring covers the HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting path.\u003c/li\u003e\n\u003cli\u003eUse the risk-based alerting framework to aggregate instances of this registry modification with other suspicious behaviors associated with DarkGate.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T18:12:19Z","date_published":"2026-10-12T18:12:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-wer-dontshowui-modification/","summary":"The DarkGate malware modifies the Windows Error Reporting 'DontShowUI' registry key to 0x00000001, suppressing error dialogs to remain stealthy during malicious installation.","title":"Modification of Windows Error Reporting Registry Key by DarkGate Malware","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-wer-dontshowui-modification/"},{"_cs_actors":["DarkGate"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["darkgate","malware","defense-evasion","windows"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eDarkGate malware, a sophisticated threat actor toolset, has been observed modifying the Windows registry key 'DisableRemoteDesktopAntiAlias' to a value of 0x00000001. This specific modification is intended to disable font anti-aliasing for Remote Desktop Protocol (RDP) sessions, a technique used by the malware to enhance the quality and performance of its remote control sessions for the attacker. By altering this setting, the malware ensures that its clandestine remote access operations are more responsive and visually clear, facilitating easier movement and command execution on compromised hosts. This activity is a critical indicator of post-compromise activity, suggesting the attacker has achieved sufficient privilege to manipulate system settings to maintain long-term persistence and refined control over the target environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial infection typically via malicious email attachment or drive-by download.\u003c/li\u003e\n\u003cli\u003eMalware payload executes on the target endpoint.\u003c/li\u003e\n\u003cli\u003eMalware gains persistence and elevates privileges if necessary.\u003c/li\u003e\n\u003cli\u003eMalware performs reconnaissance on the system configuration.\u003c/li\u003e\n\u003cli\u003eAttacker scripts modify the Windows Registry key 'DisableRemoteDesktopAntiAlias' to 0x00000001.\u003c/li\u003e\n\u003cli\u003eMalware configures or leverages existing RDP functionality for stealthy remote control.\u003c/li\u003e\n\u003cli\u003eAttacker maintains remote access to the host for data exfiltration or lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution of this registry modification allows the DarkGate malware to achieve optimized remote control over a victim machine. This compromises the confidentiality and integrity of the affected host, providing the attacker with a stable channel to execute further malicious commands, steal sensitive data, and navigate the corporate network. If left unmonitored, this access can lead to widespread credential theft or ransomware deployment depending on the attacker's ultimate objective.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for registry modification events on the identified key.\u003c/li\u003e\n\u003cli\u003eConfigure Sysmon EventID 13 to record modifications to 'Terminal Services' registry subkeys.\u003c/li\u003e\n\u003cli\u003eUse the drilldown search provided in the brief to identify hosts with this registry modification for further incident investigation.\u003c/li\u003e\n\u003cli\u003eFilter alerts based on legitimate system administration activity, such as authorized configuration changes by IT staff.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:11:31Z","date_published":"2026-10-12T18:11:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-darkgate-registry-modification/","summary":"The DarkGate malware modifies the Windows registry key 'DisableRemoteDesktopAntiAlias' to 0x00000001, disabling anti-aliasing to optimize remote control capabilities and maintain unauthorized access.","title":"DarkGate Malware Registry Modification for Remote Desktop Persistence","url":"https://feed.craftedsignal.io/briefs/2026-10-darkgate-registry-modification/"}],"language":"en","title":"CraftedSignal Threat Feed - DarkGate","version":"https://jsonfeed.org/version/1.1"}