H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[DarkComet](https://attack.mitre.org/software/S0334) is a Windows remote administration tool and backdoor.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)

Labels

malware

21 recorded

Relationships

uses

from APT38

Group

uses

to Audio Capture

Technique

uses

to Clipboard Data

Technique

uses

to Command and Scripting Interpreter

Technique

uses

to Disable or Modify Tools

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Keylogging

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Software Packing

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Video Capture

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Host Firewall

Technique

uses

from SilverTerrier

Group

uses

from Transparent Tribe

Group

8 external

References

mitre-attack

S0334

open

DarkComet

—

DarkKomet

—

Fynloski

—

Krademok

—

FYNLOS

—

Malwarebytes DarkComet March 2018

https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/

open

TrendMicro DarkComet Sept 2014

https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET

open