DCRAT
Software · ATTACK:enterprise:S9017
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9017",
"title": "DCRAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9017",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--2f481072-e9f8-4452-be00-d1d7e43c2edc",
"external_id": "S9017",
"domain": "enterprise",
"created": "2026-04-16T18:23:44.020Z",
"modified": "2026-05-12T15:12:00.740Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Zscaler BlindEagle DEC 2025",
"url": "https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"
}
]
}Explicit source assertions (5)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S9017
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48e24403-e88b-4d73-9830-e1fe3d200b86
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9017 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59e256fe-638f-4b1f-81d0-3329b05a1443
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9017 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f3aca10-b419-4cfe-bbb8-06e3973e6c0e
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9017 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b693efc4-a3e5-4378-9aa0-fad7c653e63e
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9017 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c90b713d-1c0d-4b74-acf9-43644d08c52e
Zscaler BlindEagle DEC 2025