Kaspersky's Dtrack research began with ATMDtrack malware targeting Indian ATMs and expanded into more than 180 related Dtrack samples used against India's financial sector and research centers. The tooling used encrypted overlay payloads, runtime decryption, process hollowing, and spying components, and Kaspersky linked the RAT family to Lazarus through code similarities with older malware.