DarkComet

Description

DarkComet is a remote access trojan that provides extensive control capabilities on infected Windows systems, including remote desktop, keystroke capture, camera access, and file management. Its free builder made it enormously popular before its developer discontinued it in 2012, and researchers documented its use in surveillance operations against activists and journalists. Although dated, copies continue to circulate, and detections indicate an operator with full remote control of the system.

Stats

First seen: April 2022
Last seen: October 2026

Also known as

DarkKometFynloskiKrademok

MITRE ATT&CK techniques

18 techniques across 8 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location

TA0007 Discovery

T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.001Remote Desktop Protocol

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1115Clipboard Data
T1123Audio Capture
T1125Video Capture

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0112 Defense Impairment

T1112Modify Registry
T1685Disable or Modify Tools
T1686Disable or Modify System Firewall
- T1686.003Windows Host Firewall

Associated groups

Alert name variants

Alert Name	Engine
Backdoor.DarkKomet.F	AV
Backdoor.DarkKomet.O	AV
ByteCode-MSIL.Backdoor.DarkComet	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Backdoor.Fynloski	ATP Sandbox Adv. Heuristics
Dropped:Backdoor.DarkKomet.O	AV
GenPack:Backdoor.DarkKomet.O	AV
Script-AutoIt.Backdoor.Fynloski	ATP Sandbox Adv. Heuristics
Script-JS.Backdoor.DarkComet	ATP Sandbox Adv. Heuristics
Script-JS.Backdoor.Fynloski	ATP Sandbox Adv. Heuristics
Win32.Backdoor.DarkComet	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Fynloski	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Krademok	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Fynloski	ATP Sandbox Adv. Heuristics

Related families

Metamorfo njRAT InvisiMole KONNI Agent Tesla