{"id":12282,"date":"2019-09-25T11:28:09","date_gmt":"2019-09-25T08:28:09","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=12282"},"modified":"2026-03-27T18:37:03","modified_gmt":"2026-03-27T15:37:03","slug":"dtrack-previously-unknown-spy-tool-by-lazarus-hits-financial-institutions-and-research-centers","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/dtrack-previously-unknown-spy-tool-by-lazarus-hits-financial-institutions-and-research-centers\/","title":{"rendered":"DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers"},"content":{"rendered":"\n

Kaspersky Global Research and Analysis Team have discovered a <\/strong>previously unknown <\/strong>spy tool, which had been spotted in Indian financial institutions and research centers. Called Dtrack, this spyware reportedly was created by the Lazarus group and is being used to upload and download files to victims\u2019 systems, record key strokes and conduct other actions typical of a malicious remote administration tool (RAT).<\/strong><\/p>\n\n\n\n

In 2018, Kaspersky researchers discovered ATMDtrack \u2013 malware created to infiltrate Indian ATMs and steal customer card data. Following further investigation using the Kaspersky Attribution Engine and other tools, the researchers found more than 180 new malware samples which had code sequence similarities with the ATMDtrack \u2013 but at the same time clearly were not aimed at ATMs. Instead their list of functions defined them as spy tools \u2013 now known as Dtrack. Moreover, not only did the two strains share similarities with each other, but also with the 2013 DarkSeoul campaign<\/a> which was attributed to Lazarus \u2013 an infamous advanced persistence threat actor responsible for multiple cyberespionage and cyber sabotage operations.<\/p>\n\n\n\n

Dtrack can be used as a remote admin tool (RAT), giving threat actors complete control over infected devices. Criminals can then perform different operations, such as uploading and downloading files and executing key processes.<\/p>\n\n\n\n

Entities targeted by threat actors using Dtrack RAT often have weak network security policies and password standards, while also failing to track traffic across the organization. If successfully implemented, the spyware is able to list all available files and running processes, key logging, browser history and host IP addresses \u2013 including information about available networks and active connections.<\/p>\n\n\n\n

The newly discovered malware is active and based on Kaspersky telemetry, and is still used in cyberattacks.<\/p>\n\n\n\n

\u201cLazarus is a rather unusual nation state sponsored group. On one hand, as many other similar groups do, it focuses on conducting cyberespionage or sabotage operations. Yet on the other hand, it has also been found to influence attacks that are clearly aimed at stealing money. The latter is quite unique for such a high profile threat actor because generally, other actors do not have financial motivations in their operations. The vast amount of Dtrack samples we found demonstrate how Lazarus is one of the most active APT groups, constantly developing and evolving threats in a bid to affect large-scale industries. Their successful execution of Dtrack RAT proves that even when a threat seems to disappear; it can be resurrected in a different guise to attack new targets. Even if you are a research center, or a financial organization that operates solely in commercial sector with no government affiliates, you should still consider the possibility of being attacked by a sophisticated threat actor in your threat model and prepare respectively,\u201d comments Konstantin Zykov security researcher at Kaspersky\u2019s Global Research and Analysis Team.<\/p>\n\n\n\n

Kaspersky products successfully detect and block the Dtrack malware.<\/p>\n\n\n\n

To avoid being affected by malware, such as Dtrack RAT, Kaspersky recommends: <\/strong><\/p>\n\n\n\n