LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0567: Dtrack

Dtrack is spyware that was discovered in 2019 and has been used against Indian financial institutions, research facilities, and the Kudankulam Nuclear Power Plant. Dtrack shares similarities with the DarkSeoul campaign, which was attributed to Lazarus Group. [1][2][3][4][5]

EnterpriseS0567MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Dtrack matters because ATT&CK describes it as Windows spyware associated with collection, discovery, stealth, persistence, and credential-access behaviors, with reported use against financial, research, and nuclear-sector environments. For leaders, the value is not the malware name alone; it is a reminder to validate whether Windows endpoint monitoring, identity controls, and incident response playbooks can expose quiet reconnaissance, keylogging, local data staging, and service-based persistence before sensitive data or operational context is lost.

Executive priority

Prioritize Dtrack as a resilience and evidence-readiness use case for high-value Windows environments, especially where sensitive research, finance operations, or cyber-physical dependencies exist. Executives should ask whether the organization can prove coverage for endpoint execution, Windows service changes, registry queries, process injection indicators, credential misuse, and data staging. The ATT&CK relationship to Lazarus Group increases threat-intelligence relevance, but local risk decisions should still be based on exposed assets, monitored telemetry, and incident response readiness rather than assumed targeting.

Technical view

SOC and IR teams should map Dtrack coverage to the ATT&CK relationships: Windows Command Shell execution, Windows service and autostart persistence, registry and system discovery, process hollowing, keylogging, local data collection/staging/archive activity, file deletion, embedded payloads, shared module loading, and valid account abuse. Because no official ATT&CK detection text is provided, detection engineering should validate behavior-based analytics rather than rely on a named-malware signature. Focus on correlated sequences: suspicious cmd execution followed by discovery commands, registry queries, service creation or modification, unusual module loading or process hollowing signals, collection from local files or browser data, archive creation, and cleanup activity.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Windows service creation/modification and boot/logon autostart evidence
  • Registry access and modification logs where available
  • EDR memory/process injection or process hollowing alerts
  • File system events for discovery, staging, archive creation, embedded payload drops, and deletion

Detection direction

  • Build detections around behavior chains, not only Dtrack-specific names or hashes, because the ATT&CK object provides no official detection guidance.
  • Correlate discovery activity such as registry, process, network configuration, network connections, system information, and file/directory enumeration with later staging or archive activity.
  • Tune Windows service and autostart detections to distinguish approved administration/software deployment from unusual persistence paths, suspicious binaries, or unexpected account context.
  • Validate process hollowing and shared-module-loading visibility through EDR telemetry; these are common blind spots when only basic Windows logs are collected.
  • Review keylogging-related alerts carefully because direct evidence may depend on endpoint sensor capability and can be noisy without process lineage and user context.

Mitigation priorities

  • Harden and monitor privileged and remote-capable accounts, including MFA and least privilege where applicable, because ATT&CK maps Dtrack to Valid Accounts.
  • Restrict and audit Windows service creation, boot/logon autostarts, and command shell use on sensitive systems.
  • Ensure EDR or equivalent endpoint controls can observe process injection, suspicious module loading, file staging, archive creation, and deletion.
  • Reduce unnecessary local sensitive data exposure on Windows endpoints and enforce data handling controls for high-value systems.
  • Maintain application control, script/command execution governance, and change control for systems supporting finance, research, or operational technology-adjacent functions.
Additional notes and limits

The supplied ATT&CK object identifies Dtrack as Windows spyware discovered in 2019 and reports use against Indian financial institutions, research facilities, and the Kudankulam Nuclear Power Plant. ATT&CK also relates Dtrack to Lazarus Group and to multiple techniques spanning execution, discovery, collection, stealth, persistence, credential access, and command-and-control. This take uses those relationships for defensive prioritization but does not infer current activity, customer exposure, or guaranteed detection.

Official ATT&CK detection guidance is not provided for this malware object. The relationship context gives technique mappings but not complete procedures, indicators, commands, hashes, infrastructure, or validated analytic logic. Local telemetry, asset criticality, identity architecture, and endpoint control coverage are required to determine actual risk and detection quality.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Dtrack

Dtrack is spyware that was discovered in 2019 and has been used against Indian financial institutions, research facilities, and the Kudankulam Nuclear Power Plant. Dtrack shares similarities with the DarkSeoul campaign, which was attributed to Lazarus Group. [1][2][3][4][5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

23 rows
DomainIDNameRelationship / procedure
EnterpriseT1005Data from Local System

Dtrack can collect a variety of information from victim machines.[4]

EnterpriseT1074.001Local Data StagingSub-technique

Dtrack can save collected data to disk, different file formats, and network shares.[2][4]

EnterpriseT1082System Information Discovery

Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.[2][4]

EnterpriseT1574Hijack Execution Flow

One of Dtrack can replace the normal flow of a program execution with malicious code.[4]

EnterpriseT1056.001KeyloggingSub-technique

Dtrack’s dropper contains a keylogging executable.[2]

EnterpriseT1547Boot or Logon Autostart Execution

Dtrack’s RAT makes a persistent target file with auto execution on the host start.[2]

EnterpriseT1543.003Windows ServiceSub-technique

Dtrack can add a service called WBService to establish persistence.[4]

EnterpriseT1059.003Windows Command ShellSub-technique

Dtrack has used cmd.exe to add a persistent service.[4]

EnterpriseT1078Valid Accounts

Dtrack used hard-coded credentials to gain access to a network share.[4]

EnterpriseT1070.004File DeletionSub-technique

Dtrack can remove its persistence and delete itself.[2]

EnterpriseT1217Browser Information Discovery

Dtrack can retrieve browser history.[2][4]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.[4]

EnterpriseT1049System Network Connections Discovery

Dtrack can collect network and active connection information.[2]

EnterpriseT1027.009Embedded PayloadsSub-technique

Dtrack has used a dropper that embeds an encrypted payload as extra data.[2]

EnterpriseT1012Query Registry

Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.[4]

EnterpriseT1055.012Process HollowingSub-technique

Dtrack has used process hollowing shellcode to target a predefined list of processes from %SYSTEM32%.[2]

EnterpriseT1083File and Directory Discovery

Dtrack can list files on available disk volumes.[2][4]

EnterpriseT1016System Network Configuration Discovery

Dtrack can collect the host's IP addresses using the ipconfig command.[2][4]

EnterpriseT1057Process Discovery

Dtrack’s dropper can list all running processes.[2][4]

EnterpriseT1560Archive Collected Data

Dtrack packs collected data into a password protected archive.[2]

EnterpriseT1129Shared Modules

Dtrack contains a function that calls LoadLibrary and GetProcAddress.[4]

EnterpriseT1105Ingress Tool Transfer

Dtrack’s can download and upload a file to the victim’s computer.[2][4]

EnterpriseT1140Deobfuscate/Decode Files or Information

Dtrack has used a decryption routine that is part of an executable physical patch.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1574: Hijack Execution FlowEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1547: Boot or Logon Autostart ExecutionEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1078: Valid AccountsEnterpriseuses · GroupG0032: Lazarus GroupEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1217: Browser Information DiscoveryEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1027.009: Embedded PayloadsEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1560: Archive Collected DataEnterpriseuses · TechniqueT1129: Shared ModulesEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
a0232f85d6396d50...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundlea0232f85d639…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky Dtrack

    Kaspersky Global Research and Analysis Team. (2019, September 23). DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers. Retrieved January 20, 2021.

    Open source URL
  2. [2]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  3. [3]
    Dragos WASSONITE

    Dragos. (n.d.). WASSONITE. Retrieved January 20, 2021.

    Open source URL
  4. [4]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  5. [5]
    ZDNet Dtrack

    Catalin Cimpanu. (2019, October 30). Confirmed: North Korean malware found on Indian nuclear plant's network. Retrieved January 20, 2021.

    Open source URL
  6. [6]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  7. [7]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  8. [8]
    Dragos WASSONITE

    Dragos. (n.d.). WASSONITE. Retrieved January 20, 2021.

    Open source URL
  9. [9]
    Dragos WASSONITE

    Dragos. (n.d.). WASSONITE. Retrieved January 20, 2021.

    Open source URL
  10. [10]
    Kaspersky Dtrack

    Kaspersky Global Research and Analysis Team. (2019, September 23). DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers. Retrieved January 20, 2021.

    Open source URL
  11. [11]
    Kaspersky Dtrack

    Kaspersky Global Research and Analysis Team. (2019, September 23). DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers. Retrieved January 20, 2021.

    Open source URL
  12. [12]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  13. [13]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  14. [14]
    ZDNet Dtrack

    Catalin Cimpanu. (2019, October 30). Confirmed: North Korean malware found on Indian nuclear plant's network. Retrieved January 20, 2021.

    Open source URL
  15. [15]
    ZDNet Dtrack

    Catalin Cimpanu. (2019, October 30). Confirmed: North Korean malware found on Indian nuclear plant's network. Retrieved January 20, 2021.

    Open source URL
  16. [16]
    mitre-attackS0567
    Open source URL
  17. [17]
    mitre-attackS0567
    Open source URL
  18. [18]
    mitre-attackS0567
    Open source URL
  19. [19]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  20. [20]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  21. [21]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  22. [22]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  23. [23]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  24. [24]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  25. [25]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  26. [26]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  27. [27]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  28. [28]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  29. [29]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  30. [30]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  31. [31]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  32. [32]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  33. [33]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  34. [34]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  35. [35]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  36. [36]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  37. [37]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  38. [38]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  39. [39]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  40. [40]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  41. [41]
    Kaspersky Dtrack

    Kaspersky Global Research and Analysis Team. (2019, September 23). DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers. Retrieved January 20, 2021.

    Open source URL
  42. [42]
    Kaspersky Dtrack

    Kaspersky Global Research and Analysis Team. (2019, September 23). DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers. Retrieved January 20, 2021.

    Open source URL
  43. [43]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  44. [44]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  45. [45]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  46. [46]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  47. [47]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  48. [48]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  49. [49]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  50. [50]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  51. [51]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  52. [52]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  53. [53]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  54. [54]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  55. [55]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  56. [56]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  57. [57]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  58. [58]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  59. [59]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  60. [60]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  61. [61]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  62. [62]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  63. [63]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  64. [64]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  65. [65]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  66. [66]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  67. [67]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  68. [68]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  69. [69]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  70. [70]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  71. [71]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  72. [72]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  73. [73]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  74. [74]
    CyberBit Dtrack

    Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.

    Open source URL
  75. [75]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  76. [76]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use