MALWARE FAMILY

Dacls

Internal ID: elf.dacls

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely.

Research shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems with other malware, and so on. In any case, no RAT is harmless and should be uninstalled immediately.

Threat Analysis

Dacls is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.netlab.360.com/dacls-the-dual-platform-rat/

→https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought

→https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/

→https://securelist.com/apt-trends-report-q2-2020/97937/

→https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/

→https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/

→https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf

→https://vblocalhost.com/uploads/VB2021-Park.pdf

→https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/

→https://www.sygnia.co/mata-framework

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.dacls

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Dacls