DarkGate is primarily in the hands of financially motivated groups like TA577 and Ducktail and RaaS operators like BianLian and Black Basta. These groups focus on European and American financial institutions, employing double extortion ransomware attacks to squeeze maximum profit Overview of DarkGate version 5 activity They exploit legitimate services like Google’s DoubleClick advertising network and cloud storage to trick victims into downloading the malware.

Source: GBHackers