{
  "family": "darkkomet",
  "sample_count": 801,
  "category": "rat",
  "description": "<h3>Executive Summary</h3>\nDarkComet (often detected as DarkKomet) is one of the most infamous and widely used Remote Access Trojans (RATs) in history. Originally developed in 2008 as a legitimate Remote Administration Tool, its powerful surveillance capabilities, ease of use, and free availability led to its massive adoption by cybercriminals, script kiddies, and APT groups. It provides an attacker with complete, stealthy, interactive control over a victim's Windows machine.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDarkComet is distributed via virtually every known vector: spear-phishing emails, malicious torrents (disguised as game cracks or software), malicious links in Discord/Skype, and drive-by downloads.\n\nOnce installed, it operates as a full-featured espionage platform:\n<ul>\n<li><strong>Total Surveillance:</strong> The RAT allows the attacker to secretly view the victim's webcam, listen to the microphone, capture the desktop screen in real-time, and log every keystroke (keylogger).</li>\n<li><strong>System Administration:</strong> The attacker has full GUI-based control over the file system (upload/download/execute), can edit the Windows Registry, manage running processes, and open remote command shells (cmd.exe).</li>\n<li><strong>DDoS and Network Abuse:</strong> DarkComet clients can be clustered together by the \"botmaster\" to launch coordinated Distributed Denial of Service (DDoS) attacks, or utilized as proxy nodes to mask the attacker's true IP address when attacking other targets.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA DarkComet infection represents a total and catastrophic compromise of the endpoint. The attacker possesses the same level of access as the logged-in user (often SYSTEM level) and can steal any data, deploy ransomware, or pivot to attack the rest of the corporate network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> The endpoint must be physically disconnected from the network immediately to kill the active remote session and halt the live exfiltration of video, audio, and files.</li>\n<li><strong>Incident Containment (Lateral Movement):</strong> Incident responders must assume the attacker used the DarkComet beachhead to move laterally. Scrutinize Active Directory authentication logs and internal firewall traffic to ensure the attacker did not compromise other servers.</li>\n<li><strong>Total Re-imaging and Credential Wipe:</strong> The machine is completely untrusted and must be wiped to bare metal. All credentials used on that machine must be reset globally.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "RAT.DarkComet",
    "Backdoor.Win32.DarkKomet",
    "Trojan.DarkComet"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is DarkComet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A Windows remote administration tool and backdoor used to fully control and surveil an infected computer."
      }
    },
    {
      "@type": "Question",
      "name": "Is DarkComet still developed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Official development stopped, but leaked versions continued to be used by various actors."
      }
    },
    {
      "@type": "Question",
      "name": "What can DarkComet do?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remote control, keylogging, webcam capture, and credential theft."
      }
    },
    {
      "@type": "Question",
      "name": "What are DarkComet's other names?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Detection names include Fynloski and Krademok."
      }
    },
    {
      "@type": "Question",
      "name": "How does DarkComet spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through phishing, malicious downloads, and bundling with other files."
      }
    },
    {
      "@type": "Question",
      "name": "Where is the authoritative reference?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's DarkComet entry (S0334), linked on this page."
      }
    }
  ],
  "faq_count": 6,
  "mitre_attack": [
    "T1071.001",
    "T1056.001",
    "T1125"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:47:42Z",
  "sources": [
    {
      "name": "MITRE ATT&CK: DarkComet (S0334)",
      "url": "https://attack.mitre.org/software/S0334"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0334",
  "type": "Remote Access Trojan (RAT)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}