Loading story…
The Lazarus Group used its DTrack malware in sustained espionage operations against financial institutions, research centers, utilities, government entities, telecommunications providers, IT services, and chemical manufacturers, with victim telemetry extending from Asia into Europe and Latin America. Reporting tied DTrack to intrusions at organizations including a nuclear power facility in India, where investigators said the malware was deployed as a second-stage tool after initial access had already been obtained, underscoring its role in targeted reconnaissance and data theft rather than broad disruptive activity.
Researchers described DTrack as a modular backdoor and remote administration tool that evolved over time while preserving core spying functions. Samples were observed collecting browser history, IP and network configuration data, running process lists, connection status to internal systems, and file inventories, then archiving and copying results to remote shares. Later variants added multi-stage unpacking, layered shellcode, modified RC4/RC5/RC6-based decryption, API hashing, and process hollowing into explorer.exe, while public detection content, including YARA rules and associated SHA-256 hashes, was released to help defenders identify known DTrack artifacts and infrastructure patterns.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Securelist reported continued Lazarus use of DTrack, describing newer multi-stage variants and expanded victim telemetry across Europe and Latin America.
A GitHub repository entry was updated with a YARA rule named "dtrack_2020" and associated SHA-256 hashes for detecting DTrack malware linked to Lazarus.
Cyberbit published analysis stating that a DTrack variant was found in India's Kudankulam Nuclear Power Plant and that the sample contained hardcoded internal network credentials, indicating a targeted intrusion.
Kaspersky publicly reported DTrack as a previously unknown Lazarus-linked spy tool and said it had hit financial institutions and research centers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourcegithub.com
Open sourcecyberbit.com
Open sourceusa.kaspersky.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lazarus targeted South Korean organizations through watering-hole attacks and spearphishing, abusing vulnerable local security software including **INITECH INISAFE CrossWeb EX** and **DreamSecurity MagicLine** to gain initial access and execute malware. AhnLab linked one 2022 wave to a signed INITECH process, `inisafecrosswebexsvc.exe`, after a malicious `SCSKAppLink.dll` was injected to fetch additional payloads from attacker-controlled infrastructure. Across multiple campaigns, victims included defense, finance, media, IT, public-sector, manufacturing, logistics, and pharmaceutical organizations, with reports describing more than 100 incidents and repeated use of compromised Korean websites, IP filtering, staged loaders, DLL side-loading, Windows service abuse, and persistence via the LSA Security Packages registry path. After compromise, Lazarus deployed backdoors including **NukeSped** and in some cases escalated to kernel-level evasion using a **bring your own vulnerable driver** technique. AhnLab said the group abused the signed but vulnerable `ene.sys` driver, and in some variants Dell's `CVE-2021-21551` driver path, to obtain arbitrary kernel memory access and disable security controls in memory, including file and registry callbacks, process and thread monitoring, WFP network filters, and ETW tracing. The activity also involved lateral movement through WMI, and sometimes RDP or SSH, plus credential theft, keylogging, screen capture, SOCKS tunneling, port forwarding, and internal reconnaissance, underscoring a sustained espionage-focused campaign that also created opportunities for supply-chain access and financial theft.
Aug 15, 2026
Researchers tied the **VHD ransomware** and related families including **BEAF, PXJ, ZZZZ, CHiCHi, and Tflower** to DPRK-affiliated operators, with Trellix and Kaspersky linking the activity to **Lazarus/APT38/Unit 180**. The reporting says the campaigns were narrowly targeted, especially in the APAC region, and appeared aimed at revenue generation rather than mass extortion. Investigators cited shared code, overlapping artifacts, near-identical visual patterns, a reused ProtonMail address, and the use of the **MATA** framework as evidence that these ransomware strains were not typical criminal affiliate tools but part of a state-linked operation. Kaspersky described two 2020 intrusions in which attackers exploited a vulnerable VPN gateway, escalated privileges, deployed **MATA**, seized **Active Directory**, and pushed VHD across victim networks within hours; another case used a custom SMB brute-force spreading tool with propagation over mounted shares and **WMI**. Separate research from Netlab 360 and VMware detailed **Dacls**, also known as **MATA**, as a cross-platform Lazarus-linked RAT for Windows and Linux that uses TLS and RC4-protected command-and-control, modular plugins, and infrastructure that remained active across more than 100 identified C2 servers. Earlier ESET analysis placed the activity within Lazarus’s broader pattern of combining espionage, sabotage, and financially motivated operations through multiple code-sharing development cells.
Aug 15, 2026
Fox-IT reported that a Lazarus-linked intrusion set targeted financial and cryptocurrency organizations with a stealthy three-stage malware chain built around **DPAPILoader**, **RemotePELoader**, and the memory-resident **RemotePE** RAT. The first stage decrypts a victim-bound payload using Windows **DPAPI** and XOR obfuscation, then establishes persistence through masqueraded services or DLL sideloading. The second stage prepares execution by using **HellsGate/TartarusGate** techniques to evade user-mode hooks and patching **ETW** telemetry before contacting command-and-control infrastructure for the final payload. The final-stage **RemotePE** implant operates entirely in memory and supports file management, process control, command execution, configuration changes, sleep control, and plugin loading without writing itself to disk. Researchers said the toolset is engineered for stealth through environmental keying, low forensic footprint, and likely actor-operated payload delivery, and linked the activity to a North Korean Lazarus subgroup associated with **AppleJeus**, **Citrine Sleet**, **UNC4736**, and **Gleaming Pisces**. Fox-IT also identified **Namecheap**-hosted infrastructure, active and historical domains, malware samples, host indicators, and **YARA** rules to aid detection and response.
Jun 29, 2026