'Dtrack' malware detected in 18 states, Maharashtra tops: Kaspersky

As per the firm, Dtrack can be used as Remote Admin Tool (RAT), giving threat actors complete control over infected devices.

Published: 18th October 2019 08:38 PM  |   Last Updated: 18th October 2019 08:38 PM   |  A+A-

An employee works in the virus lab at the headquarters of Russian cyber security company Kaspersky Labs in Moscow

An employee works in the virus lab at the headquarters of Russian cyber security company Kaspersky Labs in Moscow. (File Photo | Reuters)


NEW DELHI: Maharashtra is in the top in the list of 18 Indian states where samples of "Dtrack" malware have been detected in financial institutions, raising significant concern for security systems, research by Russia-based cyber security firm Kaspersky revealed.

The maximum 'Dtrack' samples were found in Maharashtra (24 per cent) followed by Karnataka (18.5 per cent) and Telangana (12 per cent), said Kaspersky.

The other infected states include West Bengal, Uttar Pradesh, Tamil Nadu, Delhi and Kerala, said the firm, explaining that Dtrack is a spy tool which had been spotted in Indian financial institutions and research centres last year.

Marking the security concerns, the firm said that the newly-discovered malware is "active and based on Kaspersky telemetry", and is still used in "cyber attacks". The firm said that its researchers in 2018 discovered "ATMDtrack"- a malware created to infiltrate Indian Automated Teller Machines (ATMs) and steal customer card data.

"Following further investigation using the Kaspersky Attribution Engine and other tools, the researchers found more than 180 new malware samples which had code sequence similarties with the ATMDtrack - but at the same time clearly were not aimed at ATMs. Instead their list of functions defined them as spy tools - now known as Dtrack," Kaspersky said.

Moreover, not only did the two strains share similarities with each other, but also with the 2013 Dark Seoul campaign which was attributed to Lazarus - an infamous advanced persistent threat actor responsible for multiple cyberespionage and cyber sabotage operations, Kaspersky said.

As per the firm, Dtrack can be used as Remote Admin Tool (RAT), giving threat actors complete control over infected devices. "Criminals can then perform different operations, such as uploading and downloading files and executing key processes."

Saurabh Sharma, Senior Security Researcher Global Research and Analysis Team (GReAT), Kaspersky (APAC), said: "Although we have seen the number of local threats in India decreasing in the last quarter compared to last year, the country is still consistently ranked as top 10 countries in Kaspersky's Cybermap Real Time Threat."

"This shows that India still needs to continue increasing its cyber security efforts, and the advanced persistent threat attack highlights the importance of investigating in threat landscape intelligence."

To avoid being affected by the malware such as Dtrack RAT, Kaspersky recommended to tighten their network and password policies as well as perform regular security audit of an organisation's IT infrastructure.

The firm also suggests to conduct regular security training sessions for staff, use traffic monitoring software such as Kaspersky Anti Targeted Attack Platform (KATA) and use anti-virus solutions.

Explaining about Dtrack, Kaspersky's Security Researcher Konstantin Zykov, in a recent event in Delhi, had said: "The large amount of Dtrack samples we found demonstrated that Lazarus is one of the most active APT (Advanced Persistent Threat) groups, constantly developing and evolving threats in a bid to affect large-scale industries and seeking to evade detection. Their successful execution of Dtrack RAT proves that even when a threat seems to disappear, it can be resurrected in a different guise to attack new targets."

Founded in 1997, Kaspersky said its deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe.

Informing that its comprehensive security portfolio includes leading endpoint protection and a number of specialised security solutions and services to fight sophisticated and evolving digital threats, Kaspersky said it protects over 400 million users through its technologies and help 2.70 lakh corporate clients protect what matters most to them.


Disclaimer : We respect your thoughts and views! But we need to be judicious while moderating your comments. All the comments will be moderated by the editorial. Abstain from posting comments that are obscene, defamatory or inflammatory, and do not indulge in personal attacks. Try to avoid outside hyperlinks inside the comment. Help us delete comments that do not follow these guidelines.

The views expressed in comments published on are those of the comment writers alone. They do not represent the views or opinions of or its staff, nor do they represent the views or opinions of The New Indian Express Group, or any entity of, or affiliated with, The New Indian Express Group. reserves the right to take any or all comments down at any time.

flipboard facebook twitter whatsapp