Skip to content

Dtrack

Software · ATTACK:enterprise:S0567

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0567",
  "title": "Dtrack",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0567",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--f8774023-8021-4ece-9aca-383ac89d2759",
  "external_id": "S0567",
  "domain": "enterprise",
  "created": "2021-01-25T13:58:24.977Z",
  "modified": "2025-04-16T20:38:44.292Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "ZDNet Dtrack",
      "url": "https://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/"
    },
    {
      "source_name": "Dragos WASSONITE",
      "url": "https://www.dragos.com/threat/wassonite/"
    },
    {
      "source_name": "CyberBit Dtrack",
      "url": "https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"
    },
    {
      "source_name": "Kaspersky Dtrack",
      "url": "https://usa.kaspersky.com/about/press-releases/2019_dtrack-previously-unknown-spy-tool-hits-financial-institutions-and-research-centers"
    },
    {
      "source_name": "Securelist Dtrack",
      "url": "https://securelist.com/my-name-is-dtrack/93338/"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1029fab5-5714-42d0-ac04-78f4c76c3c02

CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--118d9413-0b34-47e6-b333-b712e78dc404

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b47deed-a8b9-4e0f-a47e-9570ecccaa90

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28291398-1281-404e-9603-8aae5a5a9919

CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28bde4e9-cc84-4356-a872-b18fc3dd49ab

Securelist Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1547

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e9d5640-a88d-4812-b2dc-a94621a95959

Securelist Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--372ff318-25a5-476b-9090-7e0fd4534325

CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--383eccfd-da19-4b2e-9e9c-0e36c876c2ee

CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3916c36b-bd92-4070-bc9a-6eab3d78cabd

CyberBit Dtrack

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0567

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b24afd4-b13b-4c73-bb20-aeff4a44574c

Kaspersky Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--434cc89e-291d-44e7-b18a-9710c659bd64

Securelist Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b83387a-bba5-44a9-9dc4-3aae9a916d24

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5449bc94-31c6-471a-8525-23af9cdc25bd

CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61929ceb-3933-46f1-a11b-4d67482b1d59

Securelist Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66f7fca6-b5cc-46e4-86a1-204f4b1038fa

Securelist Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b55412a-760f-4ff8-b48a-6ff3bed8b0e9

CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8906c905-87ff-48bf-b17e-1b8397ef062e

Securelist Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9866c9ca-d769-458c-9797-112beb97498d

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f0f2cd3-5bcb-48c9-812f-f8a37f3dfdd3

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be366a5f-308d-42aa-ae76-f14dbbb8b136

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d80207ae-0b3c-4f5f-ac89-9caa8c2c9beb

Securelist Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e07d9070-6989-43e7-aee0-1b18aff1ffbe

CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef463100-ac00-44ab-805b-75e4c8886699

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff8241d6-2a4c-41ea-b86d-43082ca0fb48

Securelist Dtrack

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.