DarkComet

DarkComet is a Remote Access Trojan (RAT) that opens a backdoor on infected computers, allowing unauthorized access and data theft. This malware has been classified among the top five Command and Control (C2) families, indicating its widespread usage by cybercriminals. DarkComet, along with other established tools such as PlugX, Remcos, and QuasarRAT, saw a significant increase in use in 2022. The malware's capabilities are not limited to any single category but span across post-exploitation frameworks, backdoors, and botnets. Throughout 2023, DarkComet was deployed through various means, including a downloader committed to GitHub at the beginning of the year. This downloader was used to deliver multiple threats, including DarkComet itself, DcRat, njRAT, and AgentTesla. DarkComet-related variants, such as Win.Dropper.DarkComet-10011490-1 and BlackHole (a variant of a Windows Trojan), further demonstrate the malware's versatility and persistent threat. The report from Recorded Future provides additional insight into the prevalence of DarkComet among RATs. It ranks DarkComet among the top five most-used RATs, alongside two open-source tools, AsyncRAT and Quasar RAT, and two other well-established tools, PlugX and ShadowPad. Furthermore, the report reveals C2 infrastructure associated with the DarkComet RAT, demonstrating its continued relevance in the cybersecurity landscape. Despite these insights, questions remain about whether DarkComet uses the same implant for every controller that is downloaded, which could have implications for future mitigation strategies.