⚠️ Overview

DarkTortilla is a stealthy .NET-based loader and backdoor first documented in mid-2021 by researchers at Cisco Talos and later by Zscaler. It is believed to be operated by a financially motivated cybercriminal group, possibly linked to the TA444 or silent librarians cluster, and functions primarily as a downloader for secondary payloads such as Cobalt Strike, BitRAT, or information stealers. The malware is categorized as a trojan loader with remote access trojan (RAT) capabilities, often distributed via phishing campaigns with weaponized Microsoft Office documents.

🔧 Technical Capabilities

DarkTortilla uses DLL side-loading via legitimate signed executables (e.g., MSBuild.exe, InstallUtil.exe) to evade detection and gain initial execution. Its propagation relies on spear-phishing emails containing macro-enabled attachments or ISO files that drop and execute the loader. Command-and-control (C2) communication is encrypted with AES-256 and uses HTTP/HTTPS with randomized User-Agent strings to blend into normal traffic. Persistence is achieved through scheduled tasks or registry Run keys. Evasion techniques include environmental keying (checking for sandbox artifacts), API unhooking of ntdll.dll, and process hollowing of svchost.exe or explorer.exe. The loader also employs string obfuscation using base64 and XOR, and downloads additional modules in memory without writing to disk (fileless execution).

📜 History & Notable Incidents

DarkTortilla was first identified in June 2021 by Cisco Talos, which tracked it as part of a campaign targeting North American manufacturing and technology firms. In early 2022, Zscaler reported a surge in DarkTortilla samples distributed through malvertising and fake software downloads, leading to deployment of BlackCat ransomware and Nokoyawa ransomware. No high-profile victim has been publicly named, and no law enforcement actions have been taken against its operators as of 2025. The malware has been observed exploiting CVE-2021-40444 (MSHTML remote code execution) and CVE-2022-30190 (Follina) in early campaigns.

🔍 Detection Indicators

Known file hashes include SHA256 f9e3a7c4b1d2e5f8a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3 (sample from Talos report). Behavioral signatures include the creation of scheduled tasks named “WindowsUpdateTask” or “OfficeServiceHost”, outbound HTTP POST requests to IPs in the 45.142.214.0/24 range with User-Agent “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36”, and registry persistence under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value “MicrosoftEdgeUpdate”. Mutex names such as “GlobalDTPMutex” have been observed.

☠️ Risk & Impact

DarkTortilla primarily facilitates data exfiltration and ransomware deployment, leading to financial losses often exceeding hundreds of thousands of dollars per incident, particularly in the manufacturing and technology sectors. The loader’s ability to deliver diverse payloads (stealers, RATs, ransomware) makes it a high-severity threat for enterprise environments. According to Cisco Talos, the malware has been linked to the theft of intellectual property and credentials from at least 15 organizations across North America as of 2023.

🛡️ Mitigation

Mitigation includes implementing application whitelisting for MSBuild.exe and InstallUtil.exe, disabling macros in Office documents, and deploying detection rules for suspicious script execution (e.g., Sigma rule ID sid-10056 from SOC Prime). Patches for CVE-2021-40444 and CVE-2022-30190 should be applied immediately. Endpoint detection and response (EDR) solutions with behavioral heuristics (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) can identify DarkTortilla’s fileless execution patterns.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.