DarkComet

DarkComet is a Windows remote access trojan and backdoor used to remotely control compromised systems. It is a long-established commodity RAT associated with surveillance, credential and data theft, and general post-compromise system administration by attackers. The malware supports remote command execution and broad host control functions, including process and service management, file transfer and file manipulation, registry modification, remote desktop access, script execution, system reboot or shutdown, and proxying capabilities. Documented collection features include keylogging, clipboard theft, webcam capture, host user discovery, and exfiltration of stolen data such as keystroke logs.

DarkComet has been observed in both opportunistic and targeted intrusion activity. It has been used by threat actors in spearphishing campaigns with malicious documents, including operations attributed to ModifiedElephant and activity associated with Transparent Tribe reporting. It has also appeared in more recent malware distribution campaigns abusing Steam Workshop and Wallpaper Engine application wallpapers, where weaponized wallpaper packages silently installed a DarkComet-family backdoor while presenting benign-looking content to the victim. In those campaigns, DarkComet was one of several payloads delivered to gamers, alongside infostealers, loaders, cryptominers, and ransomware, with Steam account theft and session abuse as prominent objectives.

DarkComet targets Windows systems and is commonly characterized as a RAT/backdoor family rather than a specialized stealer. Its functionality makes it suitable for persistent access, surveillance, and follow-on payload delivery, and it remains a recognizable malware family in incident response despite its age.