DarkTrack RAT
DarkTrack RAT is a remote access trojan referenced in CERT-UA reporting as tooling used by the threat group UAC-0050. CERT-UA assessed UAC-0050 activity as spanning cyber-espionage, theft of funds, and information-psychological operations conducted under the “Fire Cells Group” brand. In that reporting, DarkTrack RAT was listed alongside other malware and RAT families including Remcos, TEKTONITRMS, MeduzaStealer, LummaStealer, Xeno RAT, SectopRAT, and MarsStealer. Separately, reporting cited in the source material states that an actor dubbed PseudoSticky targeted Russian organizations while deploying RemcosRAT and DarkTrack RAT. The provided content does not include specific technical details for DarkTrack RAT’s internal capabilities, infection chain, persistence, or command-and-control protocol beyond its identification as a RAT used in these campaigns. High-confidence associated context includes targeting of Ukrainian enterprises and individual entrepreneurs by UAC-0050 during September–October 2024, including compromises of accountants’ computers and attempted fraudulent payments through remote banking systems, as well as targeting of Russian organizations by PseudoSticky. No DarkTrack-RAT-specific indicators of compromise are explicitly provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique“Victims are typically infected by phishing emails containing malicious attachments that lead to the deployment of the trojans.”
Command and Control
1 techniqueC2 Tracker is a free-to-use-community-driven IOC feed that uses Shodan and Censys searches to collect IP addresses of known malware/botnet/C2 infrastructure.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan used for comprehensive data theft and remote control; delivered via PureCrypter in the described attack chain.
Named RAT in the toolset attributed to UAC-0050, used for remote control of victim machines to support theft and espionage objectives.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.