MITRE ATT&CKsoftware (malware)
S0497 Dacls
- Domain
- enterprise
- Platforms
- macOS, Linux, Windows
- Version
- 1.1
- Created
- 2020-08-07
Description
Dacls is a multi-platform remote access tool used by Lazarus Group since at least December 2019.
Related
Uses · MITRE ATT&CK (9)
- T1027.013 Encrypted/Encoded File sub-technique
- T1071.001 Web Protocols sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1543.001 Launch Agent sub-technique
- T1543.004 Launch Daemon sub-technique
- T1036 Masquerading technique
- T1057 Process Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G0032 Lazarus Group group
References
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/ TrendMicro macOS Dacls May 2020
- https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/ SentinelOne Lazarus macOS July 2020