Malwarehigh
Dacls RAT, the first Lazarus malware that targets Linux devices
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-3396 | Server-Side Template Injection RCE in Atlassian Confluence Server and Data Center | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | areac-agr.com | s of both Windows and Linux Dacls on the server: http://www.areac-agr[.]com/cms/wp-content/uploads/2015/12/ along with a working expl |
| domain | thevagabondsatchel.com | he Lazarus Group hackers, for example, the download server ‘thevagabondsatchel[.]com‘ was involved in past campaigns of the Lazarus APT. The n |
From the original article
2 min read at securityaffairs.com
Researchers spotted a new Remote Access Trojan (RAT), dubbed Dacls, that was used by the Lazarus APT group to target both Windows and Linux devices. Experts at Qihoo 360 Netlab revealed that the North-Korea Lazarus APT group used a new Remote Access Trojan (RAT), dubbed Dacls, to target both Windows and Linux devices.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.