360 Netlab analyzed Dacls, a dual-platform RAT family for Linux and Windows that it assessed as potentially linked to Lazarus Group based on related samples, shared C2 instruction codes, VirusTotal/community references, and infrastructure associated with prior Lazarus reporting. Linux.Dacls runs as a daemon, stores AES-encrypted configuration, and communicates with C2 through TLS plus RC4-protected traffic. The Linux build includes modules for command execution, file and process management, network-access testing, C2 connection proxying, and network scanning, while Windows plugins are loaded from remote URLs. The researchers also found Dacls components alongside Socat and a Confluence CVE-2019-3396 payload, suggesting that exploitation of that vulnerability may have been used to distribute the bot.