Malware profile

Dtrack

Dtrack is spyware for Windows that MITRE ATT&CK says was discovered in 2019.

In short

Dtrack is spyware for Windows that MITRE ATT&CK says was discovered in 2019. MITRE says it has been used against Indian financial institutions, research facilities and the Kudankulam Nuclear Power Plant. MITRE lists Lazarus Group as a user and notes similarities with the DarkSeoul campaign.

Last updated 9 October 2026

Profile MapMalware

Names1names in public reportsDtrack
Techniques18ATT&CK techniques listedCollection · Discovery · Stealth
Linked Groups1groups that use itLazarus Group

In one minute

What it is: Spyware for Windows that MITRE says was discovered in 2019 and used against Indian financial institutions, research facilities and the Kudankulam Nuclear Power Plant.
What it does: Collects system, network, file and browser information, logs keystrokes, packs data into a password protected archive and can download and upload files.
Who uses it: MITRE lists Lazarus Group as a user. No government document we found attributes Dtrack in text. The joint advisory AA24-207A (25 July 2024) on Andariel lists detection rules named for Dtrack.
How it gets in: No government source we found says how Dtrack first gets in. MITRE says it has used a dropper that embeds an encrypted payload.
What to do first: Run the Dtrack YARA rules from Table 2 of advisory AA24-207A, and watch for new services and odd command line use on Windows hosts.

What it does

MITRE describes Dtrack as spyware that collects system, network and browser information, packs it into a password protected archive and can download and upload files. It also records keystrokes through a keylogger in its dropper.

No government document we found describes Dtrack in text. The joint advisory AA24-207A, which is about the North Korean group Andariel, lists detection rules named for Dtrack. That is the only government link we could prove.

Names

Public sources use several names for this malware.

Names
Name	Where it appears
Dtrack	MITRE ATT&CK software S0567 (no other alias listed); rule names in the YARA table of CISA advisory AA24-207A^{[1, 4]}

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Collection

Data from Local System T1005
It can collect a variety of information from victim machines.^[1]
Input Capture: Keylogging T1056.001
Its dropper contains a keylogging program.^[1]
Archive Collected Data T1560
It packs collected data into a password protected archive.^[1]
Data Staged: Local Data Staging T1074.001
It can save collected data to disk, in different file formats and on network shares.^[1]

Discovery

System Information Discovery T1082
It can collect the computer name, hostname and adapter information to build a unique identifier.^[1]
File and Directory Discovery T1083
It can list files on the available disk volumes.^[1]
Browser Information Discovery T1217
It can retrieve browser history.^[1]
System Network Configuration Discovery T1016
It can collect the host's IP addresses with the ipconfig command.^[1]
Process Discovery T1057
Its dropper can list all running processes.^[1]
System Network Connections Discovery T1049
It can collect network and active connection information.^[1]

Stealth

Obfuscated Files or Information: Embedded Payloads T1027.009
It has used a dropper that carries an encrypted payload as extra data.^[1]
Masquerading: Match Legitimate Resource Name or Location T1036.005
One variant can hide in copies of real programs such as OllyDbg, 7-Zip and FileZilla.^[1]
Process Injection: Process Hollowing T1055.012
It has used process hollowing shellcode to target a fixed list of processes from the System32 folder.^[1]
Indicator Removal: File Deletion T1070.004
It can remove its persistence and delete itself.^[1]

Persistence

Create or Modify System Process: Windows Service T1543.003
It can add a service called WBService to stay on the host.^[1]

Execution

Command and Scripting Interpreter: Windows Command Shell T1059.003
It has used cmd.exe to add a persistent service.^[1]

Initial Access

Valid Accounts T1078
It has used hard-coded credentials to reach a network share.^[1]

Command and Control

Ingress Tool Transfer T1105
It can download a file to, and upload a file from, the victim computer.^[1]

Timeline

2019
Dtrack discovered
MITRE says Dtrack was discovered in 2019 and used against Indian financial institutions, research facilities and the Kudankulam Nuclear Power Plant.^[1]
July 25, 2024
Joint advisory AA24-207A
The FBI and partners released an advisory on Andariel that includes YARA rules named for Dtrack.^[4]

Who uses it

Threat group Lazarus Group Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units that, they say, work for the Reconnaissance General Bureau. North Korea · Since 2009

Seen in

Incident Kudankulam nuclear plant malware, 2019 In late October 2019 researchers said the network of the Kudankulam Nuclear Power Plant in Tamil Nadu was infected with Dtrack spyware. September to November 2019 · Energy and utilities

Detection and defense

Use the official detection rules
Load the YARA rules in Table 2 of advisory AA24-207A. The advisory says they can detect malware used by the actors, and three rules are named for Dtrack: Andariel_NoPineapple_Dtrack_unpacked, Andariel_dtrack_unpacked and win_dtrack_auto.^[4]
Watch the command line
The advisory says monitoring suspicious command-line activity can protect against the group. MITRE says Dtrack used cmd.exe to add a persistent service. Tying these together is our pairing.^{[4, 1]}
Counters: T1059.003 T1543.003
Protect remote access and passwords
The advisory recommends multi-factor authentication for remote access services and changing passwords that may be compromised. MITRE says Dtrack used hard-coded credentials. The pairing is ours.^{[4, 1]}
Counters: T1078
Monitor endpoints and limit traffic
The advisory recommends endpoint monitoring, blocking unnecessary outbound connections and segmenting the network. MITRE says Dtrack can transfer files and stage data on network shares. The pairing is ours.^{[4, 1]}
Counters: T1105 T1074.001
Allow only approved tools
The advisory recommends allow-listing tools for critical assets and alerting on unexpected use of dual-use applications. MITRE says Dtrack can hide in copies of real programs. The pairing is ours.^{[4, 1]}
Counters: T1036.005

Questions

What is Dtrack?

MITRE ATT&CK describes it as spyware for Windows, discovered in 2019 and used against Indian financial institutions, research facilities and the Kudankulam Nuclear Power Plant.

Who uses Dtrack?

MITRE lists Lazarus Group as a user and says Dtrack shares similarities with the DarkSeoul campaign, which it says was attributed to Lazarus Group. The government advisory AA24-207A on Andariel lists detection rules named for Dtrack but does not describe the malware in text.

Is there an official way to detect it?

Yes. Table 2 of CISA advisory AA24-207A holds YARA rules, and three are named for Dtrack. The advisory says the rules can detect malware used by the actors.

What can Dtrack do?

MITRE lists collection of system, file, network and browser information, a keylogger in its dropper, password protected archives, file transfer, and persistence as a Windows service.

In our research

Silent Chollima: North Korea’s Dual-Track Cyber Weapon December 2025
The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025
Lazarus APT Group (APT38) August 2022
Lazarus Group Threat group

Sources

Dtrack, Software S0567 MITRE ATT&CKSupports: Description, platform, techniques and the Lazarus Group link.
Lazarus Group, Group G0032 MITRE ATT&CKSupports: Lazarus Group lists Dtrack; active since at least 2009.
Andariel, Group G0138 MITRE ATT&CKSupports: Andariel is considered a sub-set of Lazarus Group by MITRE; its software list does not include Dtrack.
North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs, AA24-207A CISASupports: Andariel advisory of 25 July 2024 with YARA rules named for Dtrack and mitigations.
North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector, AA22-187A CISASupports: Maui advisory revised July 07, 2022; does not name Dtrack.

Browse the threat library

Stay Ahead of
Digital Threats

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Dtrack

In one minute

What it does

Names

What it can do

Collection

Discovery

Stealth

Persistence

Execution

Initial Access

Command and Control

Timeline

Dtrack discovered

Joint advisory AA24-207A

Who uses it

Seen in

Detection and defense

Use the official detection rules

Watch the command line

Protect remote access and passwords

Monitor endpoints and limit traffic

Allow only approved tools

Questions

What is Dtrack?

Who uses Dtrack?

Is there an official way to detect it?

What can Dtrack do?

In our research

Sources

Browse the threat library

Keep exploring

Silent Chollima: North Korea’s Dual-Track Cyber Weapon

The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella

MITRE ATT&CK

South Korea 3.20 cyberattack on broadcasters and banks, 2013

Stay Ahead of Digital Threats

Stay Ahead of
Digital Threats