360 Netlab analyzed Dacls, a modular RAT family with both Linux and Windows variants that the researchers assessed as likely linked to Lazarus Group based on related samples, C2 references, and open-source attribution context. The investigation began with a suspicious Linux ELF sample and identified shared C2 protocol behavior across Win32.Dacls and Linux.Dacls, including TLS plus RC4-protected communications and AES-encrypted configuration data. Linux.Dacls includes plugins for command execution, file management, process management, network-access testing, C2 connection proxying, and network scanning. The report also found Dacls components hosted alongside a Confluence CVE-2019-3396 payload, leading the researchers to suspect exploitation of that vulnerability was used for distribution. Its reverse P2P proxy capability is especially significant because it can relay C2 traffic, reduce direct exposure of command infrastructure, and support deeper movement through compromised networks.