What is Dtrack, the spytool that is to blame for attacks on Indian financial institutions?

Cybersecurity firm Kaspersky announced the discovery of Dtrack, a hitherto undetected spytool which has proliferated Indian financial institutions and research centres. The new spyware is a different strain of the ARMDtrack malware that was discovered in 2018. It was created to infiltrate ATMs in the country and siphon card data of customers.

The investigation resulted in the identification of 180 new malware samples whose code held similarities with ATMDtrack. However, the new variants were not created to target ATMs. They are intended to be spy tools, tracking transaction data at financial institutions. ATMDtrack and Dtrack share similarities with the 2013 DarkSeoul campaign, whose origins were traced to Lazarus – an advanced persistence threat actor that was used for multiple cyber sabotage and espionage operations.