DarkComet
Software · ATTACK:enterprise:S0334
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0334",
"title": "DarkComet",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0334",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--53ab35c2-d00e-491a-8753-41d35ae7e547",
"external_id": "S0334",
"domain": "enterprise",
"created": "2019-01-29T19:18:28.468Z",
"modified": "2026-05-12T15:12:00.733Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "DarkComet"
},
{
"source_name": "DarkKomet"
},
{
"source_name": "Fynloski"
},
{
"source_name": "Krademok"
},
{
"source_name": "FYNLOS"
},
{
"source_name": "Malwarebytes DarkComet March 2018",
"url": "https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"
},
{
"source_name": "TrendMicro DarkComet Sept 2014",
"url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:S0334
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--074ed0d8-8a95-4090-a23b-6c3915587590
Unit 42 ProjectM March 2016ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1686.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bdf79b8-64d2-4403-b14a-4000c5867e05
Malwarebytes DarkComet March 2018 · TrendMicro DarkComet Sept 2014ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d1eaec4-ceeb-4fda-b177-f92fad7d3e44
Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28b56048-87a7-4204-b55b-3f2f79f9073f
Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30b85048-ba1f-4b43-b9bc-69c27e426039
TrendMicro DarkComet Sept 2014 · Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62442f37-7a0e-4945-b498-2d02306e53c7
TrendMicro DarkComet Sept 2014 · Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75f88090-55cb-4b3b-84af-cf51058c3ccc
TrendMicro DarkComet Sept 2014 · Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c60bccc-f485-403d-ab3b-db861a3a4429
Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--957f81a6-81cb-4279-8c88-1a0a73c2e0d6
Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1dfbc65-48dc-4218-a10c-906fbe33b6db
Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aeb0762f-0d0e-43b8-be6f-413f60097e02
TrendMicro DarkComet Sept 2014 · Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b520cfd5-438e-4f73-931b-c058ada04e2e
TrendMicro DarkComet Sept 2014 · Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5508866-69f6-4bbe-8906-9de0148d9834
Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1123
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b9f6e673-8c15-465e-9ef0-2bcc8efc586e
TrendMicro DarkComet Sept 2014 · Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c241606f-e0e2-4179-8e8d-444fb1406df4
Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c88e7db9-47b1-4fe9-943a-98ebde29980b
TrendMicro DarkComet Sept 2014 · Malwarebytes DarkComet March 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da288184-6537-4a23-b26e-e4329690bddb
TrendMicro DarkComet Sept 2014ATTACK:enterprise:G0083 → uses → ATTACK:enterprise:S0334
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e50b6d7a-8c22-45f3-9d60-383064cc58d4
Unit42 SilverTerrier 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e96e17e7-4349-4393-b875-5bab4e8ffa5a
TrendMicro DarkComet Sept 2014ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:S0334
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9e35351-d53c-4ea3-a439-d43bd636ae32
FireEye APT38 Oct 2018ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f82724f9-846b-442e-826c-a38a74a93737
TrendMicro DarkComet Sept 2014