Dacls

Executive Summary

Dacls is a cross‐platform RAT that gives Lazarus Group persistent remote access to Windows, Linux, and macOS machines. It supports covert command execution, keylogging, screenshot capture, and data exfiltration over encrypted channels. The malware’s modular design enables attackers to add or update capabilities as needed.

Dacls is a sophisticated cross‐platform remote access trojan (RAT) that has been employed by the Lazarus Group since at least December 2019. According to TrendMicro and SentinelOne, it targets Windows, Linux, and macOS systems and operates via a centralized command and control infrastructure that allows adversaries to remotely execute commands, exfiltrate data, and remain stealthy across multiple operating environments. Once installed, Dacls establishes persistence mechanisms on each platform—such as scheduled tasks on Windows, launch agents or daemons on macOS, and init scripts on Linux—to ensure it survives reboots. It injects itself into legitimate processes to evade detection and communicates with its C2 server over encrypted channels, often using custom protocol binaries that mimic legitimate traffic. Beyond remote control, the malware can capture screenshots, log keystrokes, steal credentials from browsers, and exfiltrate files via HTTP/HTTPS or FTP. The Lazarus Group has previously leveraged Dacls for data theft during several large‐scale operations in Asia and the Middle East, indicating its role in broader espionage campaigns. Overall, Dacls showcases a modular architecture where additional plug‑in components can be downloaded at runtime, allowing attackers to tailor the payload to specific objectives such as industrial reconnaissance or credential harvesting.

Key Capabilities

• Remote code execution
• Persistent installation across platforms
• Keylogging
• Screenshot capture
• Credential theft from browsers
• Data exfiltration via HTTP/HTTPS and FTP
• Process injection for stealth
• Dynamic plugin download for added functionality

ATT&CK Techniques

Recommended Actions

• Block known malicious IP addresses, domains, and TLS SNI endpoints linked to Dacls C2 servers.
• Deploy endpoint detection and response (EDR) solutions that detect process injection, suspicious scheduled tasks, and abnormal file‑system changes on all platforms.
• Implement network segmentation and strict firewall rules to limit outbound traffic to unknown or high‑risk destinations.
• Use host‐based intrusion detection systems to monitor for known malware signatures and anomalous keylogging behavior.
• Apply least privilege principles and regular patching to mitigate exploitation vectors.
• Configure threat intelligence feeds to surface new indicators of compromise (IOCs) related to Dacls.

Suggested Tags