H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Dacls](https://attack.mitre.org/software/S0497) is a multi-platform remote access tool used by [Lazarus Group](https://attack.mitre.org/groups/G0032) since at least December 2019.(Citation: TrendMicro macOS Dacls May 2020)(Citation: SentinelOne Lazarus macOS July 2020)

Labels

malware

10 recorded

Relationships

uses

to Encrypted/Encoded File

Technique

uses

to File and Directory Discovery

Technique

uses

to Hidden Files and Directories

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Launch Agent

Technique

uses

to Launch Daemon

Technique

uses

to Masquerading

Technique

uses

to Process Discovery

Technique

uses

to Web Protocols

Technique

uses

from Lazarus Group

Group

3 external

References

mitre-attack

S0497

TrendMicro macOS Dacls May 2020

https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/

SentinelOne Lazarus macOS July 2020

https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/