{
  "family": "darkmoon",
  "sample_count": 2,
  "category": "ransomware",
  "description": "Backdoor:Win32/Darkmoon (frequently associated with the commercial penetration testing framework Core Impact) is a highly sophisticated Remote Access Trojan (RAT) and post-exploitation agent. While Core Impact is a legitimate tool used by security professionals (similar to Cobalt Strike), threat actors often pirate or re-purpose its agents (like Darkmoon) to establish deep, stealthy control over compromised enterprise networks (`T1219`).<br><br><b>Understanding Darkmoon (Advanced Backdoors)</b><br>To an end-user, Darkmoon is completely invisible. For a security operations center (SOC), the detection of Darkmoon is a critical incident indicating that an advanced adversary has already bypassed perimeter defenses and achieved execution on a high-value asset. It is not an initial access vector; it is a tool for lateral movement and long-term espionage.<br><br><b>Execution and Post-Exploitation Mechanics</b><br>Darkmoon is usually deployed after an initial breach (e.g., via spearphishing or exploiting an edge service). It is designed to be highly modular and evasive. It operates entirely in memory (`T1055`), injecting itself into legitimate system processes to avoid writing a detectable executable to the hard drive. It utilizes encrypted command and control channels (often HTTPS or custom DNS tunneling) to blend in with normal enterprise traffic (`T1071.001`). From this foothold, the attacker uses Darkmoon to dump credentials (`T1003`), map the network infrastructure (`T1046`), and deploy further implants or ransomware.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and control over the infected host. Host-based IoCs are extremely subtle due to the memory-only execution; EDR solutions may detect anomalous process injection (e.g., `CreateRemoteThread`) or unexpected network connections originating from processes like `svchost.exe` or `lsass.exe`. Network IoCs involve regular beaconing behavior to unknown IP addresses or domains with unusually high entropy.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1003",
    "T1219",
    "T1046"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software (Abusing commercial post-exploitation frameworks)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Executing purely in memory to evade file-based AV)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1003",
      "name": "OS Credential Dumping (Extracting hashes for lateral movement)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery (Mapping the internal network from the compromised host)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Do NOT immediately power off or reboot the machine, as Darkmoon may be running entirely in RAM; capture a live memory image first.",
    "Isolate the host from the network at the switch level to sever the C2 connection while preserving evidence.",
    "Conduct a full Active Directory audit, assuming that any credentials used on or by the infected machine have been compromised.",
    "Hunt across the enterprise network for the C2 IP addresses or domains identified during memory analysis."
  ],
  "what_to_avoid": [
    "Do not rely on standard antivirus scans to clear a Darkmoon infection; they will almost certainly fail to detect the in-memory payload.",
    "Avoid resetting passwords from the infected machine, as the attacker likely has active keylogging modules deployed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}