Loading malware…
DarkTrack RAT is a Windows remote access trojan used in phishing-led intrusion campaigns to provide covert control of compromised systems. It has been observed alongside other commodity and criminal malware families in operations targeting Russian organizations, including scientific, industrial, governmental, and defense-related entities, as well as in financially motivated activity affecting Ukrainian organizations. Reported campaigns show it being delivered after victims open malicious executable content disguised as documents, with decoy files displayed to reduce suspicion. It has also been noted as a payload dropped via PureCrypter and as part of broader malware sets that included tools such as Remcos, Sectop RAT, Lumma Stealer, and Mars Stealer.
DarkTrack RAT is associated in the available reporting with activity attributed to Sticky Werewolf and with campaigns imitating Sticky Werewolf tradecraft. In these operations, phishing emails or phishing links were used for initial access, often themed around official or legal documents and tailored to regional targets. The malware’s role is to establish remote interactive access for post-compromise operations. High-confidence reporting in the supplied material supports its classification as a remote access trojan, but does not provide a sufficiently corroborated capability breakdown specific to DarkTrack RAT beyond remote access functionality.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In this previous campaign, the bitbucket folder contained additional malwares such as Remcos, Sectop RAT, Lumma Stealer, Mars Stealer, and Darktrack RAT.
...в которых часто встречаются такие инструменты, как трояны удаленного доступа Darktrack RAT и Ozone RAT...
5 distinct techniques documented for this family, organized by ATT&CK tactic.
В ĸачестве первоначального веĸтора атаĸ группа использует фишинговые рассылĸи по элеĸтронной почте с вредоносными вложениями... Злоумышленники отправляли вредоносные письма... В качестве приманки Sticky Werewolf использовали поддельное письмо от Минпромторга.
“Victims are typically infected by phishing emails containing malicious attachments that lead to the deployment of the trojans.”
За открытием такого файла следовала демонстрация легитимного документа соответствующего формата и инсталляция Ozone RAT или Darktrack RAT.
По фишинговым ссылкам располагались вредоносные файлы с расширением .exe или .scr, которые были замаскированы под документы Microsoft Word или PDF.
C2 Tracker is a free-to-use-community-driven IOC feed that uses Shodan and Censys searches to collect IP addresses of known malware/botnet/C2 infrastructure.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.