Loading threat actor…
DCRat, also known as DarkCrystal RAT, is a remote-access trojan used in phishing-led intrusions to establish persistent access, steal information, and enable follow-on payload delivery. It has been associated with suspected Russian threat activity and has recently been used in campaigns targeting the hospitality sector, particularly organizations in Europe, through Booking.com-themed lures and ClickFix-style social engineering. In these operations, victims are tricked into executing malicious PowerShell that abuses trusted Windows utilities such as MSBuild.exe to retrieve and launch the malware, reflecting a shift toward living-off-the-land execution and greater defense evasion. Once deployed, DCRat provides remote access to the victim system, supports keylogging, can download or drop additional payloads, and is used to maintain persistence on compromised hosts. Reported infection chains have included attempts to disable Microsoft Defender and the creation of startup-based persistence mechanisms. DCRat-related activity has also been linked to abuse of explorer.exe to open remote URLs as part of ingress tool transfer behavior. Overall, DCRat is an information-stealing and post-compromise access tool used for initial access enablement, persistence, credential or data collection, and broader post-exploitation activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Uses explorer.exe with URL arguments to open remote content via the default browser, potentially to download and execute malicious payloads.
DCRat is being used in phishing campaigns targeting the hospitality sector, delivered via fake Booking.com emails and fake BSOD screens.
DCRat is being used in a phishing campaign targeting the hospitality sector, leveraging fake Booking.com emails and social engineering to deliver remote access trojan malware.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.