S0694: DRATzarus

DRATzarus is a remote access tool (RAT) that has been used by Lazarus Group to target the defense and aerospace organizations globally since at least summer 2020. DRATzarus shares similarities with Bankshot, which was used by Lazarus Group in 2017 to target the Turkish financial sector.[1]

EnterpriseS0694MalwareObject v1.1ModifiedApr 16, 2025, 20:38 UTC (UTC+00:00)

S0694: DRATzarus describes [DRATzarus](https://attack.mitre.org/software/S0694) is a remote access tool (RAT) that has been used by [Lazarus Group](https://attack.mitre.org/groups/G0032) to target the defense and aerospace organizations globally since at least summer 2020. [DRATzarus](https://attack.mitre.org/software/S0694) shares similarities with [Bankshot](https://attack.mitre.org/software/S0239), which was used by [Lazarus Group](https://attack.mitre.org/groups/G0032) in 2017 to target the Turkish financial sector.(Citation: ClearSky La...

Executive priority

S0694: DRATzarus is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0694: DRATzarus by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0694: DRATzarus appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

DRATzarus

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques13 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1033	System Owner/User Discovery	DRATzarus can obtain a list of users from an infected machine.[1]
Enterprise	T1622	Debugger Evasion	DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.[1]
Enterprise	T1124	System Time Discovery	DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time.[1]
Enterprise	T1005	Data from Local System	DRATzarus can collect information from a compromised host.[1]
Enterprise	T1105	Ingress Tool Transfer	DRATzarus can deploy additional tools onto an infected machine.[1]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.[1]
Enterprise	T1018	Remote System Discovery	DRATzarus can search for other machines connected to compromised host and attempt to map the network.[1]
Enterprise	T1106	Native API	DRATzarus can use various API calls to see if it is running in a sandbox.[1]
Enterprise	T1027.002	Software PackingSub-technique	DRATzarus's dropper can be packed with UPX.[1]
Enterprise	T1057	Process Discovery	DRATzarus can enumerate and examine running processes to determine if a debugger is present.[1]
Enterprise	T1071.001	Web ProtocolsSub-technique	DRATzarus can use HTTP or HTTPS for C2 communications.[1]
Enterprise	T1497.003	Time Based ChecksSub-technique	DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to measure function timing.[1] DRATzarus can also remotely shut down into sleep mode under specific conditions to evade detection.[1]
Enterprise	T1027	Obfuscated Files or Information	DRATzarus can be partly encrypted with XOR.[1]

Associated objects

Groups, software, and campaigns

C0022: Operation Dream Job

Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between Operation Dream Job, Operation North Star, and Operation Interception; by 2022 security researchers described Operation Dream Job as an umbrella term covering both Operation Interception and Operation North Star.[1][2][3][4]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.1
Created: Mar 24, 2022, 11:23 UTC (UTC+00:00)
Modified: Apr 16, 2025, 20:38 UTC (UTC+00:00)
Raw hash: c333853570d92ccf...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.1	Apr 16, 2025, 20:38 UTC (UTC+00:00)	Current bundle	`c333853570d9…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Apr 16, 2025, 20:38 UTC (UTC+00:00)	Older bundle	`c333853570d9…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
ClearSky Lazarus Aug 2020
ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
Open source URL
[2]
mitre-attackS0694
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use