Dtrack

Internal ID: win.dtrack

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Dtrack is a Remote Administration Tool (RAT) developed by the Lazarus group.

Its core functionality includes operations to upload a file to the victim's computer, download a file from the victim's computer, dump disk volume data, persistence and more.

A variant of Dtrack was found on Kudankulam Nuclear Power Plant (KNPP) which was used for a targeted attack.

Threat Analysis

Dtrack is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf

→https://blog.macnica.net/blog/2020/11/dtrack.html

→https://brandefense.io/blog/apt-groups/lazarus-apt-group-apt38/

→https://github.com/jeFF0Falltrades/IoCs/blob/master/APT/dtrack_lazarus_group.md

→https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf

→https://marcoramilli.com/2019/11/04/is-lazarus-apt38-targeting-critical-infrastructures/

→https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF

→https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/

→https://securelist.com/apt-trends-report-q3-2020/99204/

→https://securelist.com/dtrack-targeting-europe-latin-america/107798/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.dtrack

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Dtrack