Dtrack — Malware Profile
Dtrack is spyware that was discovered in 2019 and has been used against Indian financial institutions, research facilities, and the Kudankulam Nuclear Power Plant. Dtrack shares similarities with the DarkSeoul campaign, which was attributed to Lazarus Group.
MITRE ATT&CK techniques (23)
- T1005 Data from Local System
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1027.009 Embedded Payloads
- T1036.005 Match Legitimate Resource Name or Location
- T1049 System Network Connections Discovery
- T1055.012 Process Hollowing
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1070.004 File Deletion
- T1074.001 Local Data Staging
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1129 Shared Modules
- T1140 Deobfuscate/Decode Files or Information
- T1217 Browser Information Discovery
- T1543.003 Windows Service
- T1547 Boot or Logon Autostart Execution
- T1560 Archive Collected Data
- T1574 Hijack Execution Flow
IntelFusions coverage
- Andariel Acted as Play Ransomware Precursor in Five-Month Network Siege, Unit 42 Reveals 2026-02-16
- Microsoft Reveals Andariel's New Dora RAT and Decade-Long Malware Arsenal Targeting Aerospace and Defence 2026-02-16
- Lazarus Group (APT38): North Korea's Most Prolific Cyber Threat Actor Targets Banks, Crypto, and Critical Infrastructure 2026-02-16
- North Korean Andariel Group Linked to Play Ransomware in Unprecedented Nation-State Collaboration 2026-02-16