{"id":20040,"date":"2018-11-23T12:33:00","date_gmt":"2018-11-23T12:33:00","guid":{"rendered":"http:\/\/a1b4a877-0114-40e3-a1ab-e471ab4644ca"},"modified":"2018-11-23T12:33:00","modified_gmt":"2018-11-23T12:33:00","slug":"ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/","title":{"rendered":"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT"},"content":{"rendered":"<p>Ukrainian police have arrested a 42-old-man on charges of infecting over 2,000 users across 50 countries with the DarkComet remote access trojan (RAT).<\/p>\n<p>The man was arrested this week after police executed a search warrant at his residence in the city of Lviv, in Western Ukraine.<\/p>\n<p>In a press release published today, Ukrainian police said they found a modified administrator panel for the DarkCommet RAT on the man&#8217;s computer, along with the malware&#8217;s installation files, and screenshots of infected victims&#8217; computers.<\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet2.cbsistatic.com\/hub\/i\/2018\/11\/23\/e973050a-48af-463e-9e82-3d1d05b8f5db\/55508f3a1f401bbf820c8d0ad43895e2\/darkcomet-admin-panel.jpg\" class=\"\" alt=\"darkcomet-admin-panel.jpg\"\/><\/span><\/p>\n<p><span class=\"caption\">Image of the suspect&#8217;s DarkComet admin panel opened on his home computer.<\/span><\/p>\n<p><span class=\"credit\">Image: Ukrainian Police<\/span><\/p>\n<p><a href=\"https:\/\/www.darkcomet-rat.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">DarkComet<\/a> was first released in 2008 and was initially advertised as a legitimate remote administration toolkit. Because of its intrusive spying capabilities, the tool was quickly adopted by malware developers, becoming a popular RAT within months [<a href=\"https:\/\/www.contextis.com\/en\/blog\/malware-analysis-dark-comet-rat\" target=\"_blank\" rel=\"noopener noreferrer\">1<\/a>, <a href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2012\/06\/you-dirty-rat-part-1-darkcomet\/\" target=\"_blank\" rel=\"noopener noreferrer\">2<\/a>].<\/p>\n<p>The tool&#8217;s author, French software developer <a href=\"https:\/\/twitter.com\/DarkCoderSc\/\" target=\"_blank\" rel=\"noopener noreferrer\">Jean-Pierre Lesueur<\/a>, stopped developing the tool <a href=\"https:\/\/www.wired.com\/2012\/07\/dark-comet-syrian-spy-tool\/\" target=\"_blank\" rel=\"noopener noreferrer\">in 2012<\/a> after it became evident that most of the tool&#8217;s use cases were for cybercrime and after reports surfaced that Syrian authorities had been using it to crack down on dissidents [<a href=\"https:\/\/asert.arbornetworks.com\/exterminating-the-rat-part-i-dissecting-dark-comet-campaigns\/\" target=\"_blank\" rel=\"noopener noreferrer\">1<\/a>, <a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/darkcomet-surfaced-in-the-targeted-attacks-in-syrian-conflict\/\" target=\"_blank\" rel=\"noopener noreferrer\">2<\/a>].<\/p>\n<p>Despite this, DarkComet development was picked up by other unofficial developers, and the RAT continued to plague users even to this day[<a href=\"https:\/\/heimdalsecurity.com\/blog\/darkcomet-rat-phishing-campaigns\/\" target=\"_blank\" rel=\"noopener noreferrer\">1<\/a>, <a href=\"https:\/\/blog.joshlemon.com.au\/new-malware-posing-as-popular-archiving-tool-peazip\/\" target=\"_blank\" rel=\"noopener noreferrer\">2<\/a>], being recently spotted even in the arsenal and operations <a href=\"https:\/\/www.zdnet.com\/article\/north-korea-is-the-most-destructive-cyber-threat-right-now-fireeye\/\" target=\"_blank\">of North Korean government-backed hackers<\/a>.<\/p>\n<p>DarkCommet works as all your typical RATs, and is comprised of &#8220;clients&#8221; that are installed on infected computers, which send data back to a &#8220;server&#8221; module &#8211;the administration panel.<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_ZD_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>The RAT clients can take screenshots of users&#8217; screens, log keystrokes, steal documents, install additional malware on victims&#8217; computers, disable OS features, and steal passwords stored inside other local apps &#8211;just to name a few of its many features.<\/p>\n<h3>How to determine if you&#8217;ve been infected<\/h3>\n<p>Ukrainian police did not release the name of the suspect they arrested this week, but they did publish instructions on how to detect if users have been infected by this man&#8217;s DarkComet campaign. The instructions are as follows:<\/p>\n<ol>\n<li>Press the <strong>Windows + R<\/strong> keys to open a Run dialog.<\/li>\n<li>Type &#8220;<strong>cmd<\/strong>&#8221; and press <strong>Enter<\/strong>.<\/li>\n<li>In the command prompt type &#8220;<strong>netstat -nao<\/strong>&#8221; and press <strong>Enter<\/strong>.<\/li>\n<li>In the list of current connections search for one trying to connect to a foreign IP address of <strong>193.53.83.233<\/strong>, on port <strong>1604<\/strong> or <strong>81<\/strong>.<\/li>\n<\/ol>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/article\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/\" class=\"lazy\" alt=\"darkcomet-check-infections.jpg\" height=\"auto\" width=\"470\" data-original=\" https:\/\/zdnet2.cbsistatic.com\/hub\/i\/r\/2018\/11\/23\/eba200bd-0b4e-4f41-8c3b-c2c4a22eb9f2\/resize\/470xauto\/90a03fb574bf713daf446d008efc93ba\/darkcomet-check-infections.jpg\"\/><\/span><noscript><\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet2.cbsistatic.com\/hub\/i\/r\/2018\/11\/23\/eba200bd-0b4e-4f41-8c3b-c2c4a22eb9f2\/resize\/470xauto\/90a03fb574bf713daf446d008efc93ba\/darkcomet-check-infections.jpg\" class=\"\" alt=\"darkcomet-check-infections.jpg\" height=\"auto\" width=\"470\"\/><\/span><\/p>\n<p><\/noscript> <span class=\"credit\">Image: Ukrainian Police<\/span><\/p>\n<p>If users find that their computer is trying to connect to such an IP address, then they&#8217;ve been infected by this particular DarkComet RAT campaign. At this point, victims should either wipe and reinstall their operating systems; use an antivirus program to remove the DarkComet malware; or contact a professional to do these things for them.<\/p>\n<p>If you&#8217;re a company, then you should contact your legal department first, as they might want to work with your IT staff to investigate and determine what data might have been stolen.<\/p>\n<p>Ukrainian police are also interested in <a href=\"https:\/\/cyberpolice.gov.ua\/declare\/\" target=\"_blank\" rel=\"noopener noreferrer\">hearing from victims<\/a>, most likely to build a better case against the suspect and determine the extent of the damage he caused.<\/p>\n<h3>Poor OpSec led to the man&#8217;s arrest<\/h3>\n<p>But while Ukrainian police didn&#8217;t reveal any details about the suspect or how they&#8217;ve tracked him down, it&#8217;s pretty clear how they&#8217;ve done it to an external observer.<\/p>\n<p>Searching for the IP address of <a href=\"https:\/\/www.shodan.io\/host\/193.53.83.233\" target=\"_blank\" rel=\"noopener noreferrer\">193.53.83.233 on Shodan<\/a>, a search engine for Internet-connected devices, we found a listing for this IP that was marked as a &#8220;DarkComet trojan&#8221; command-and-control server.<\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/article\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/\" class=\"lazy\" alt=\"darkcomet-shodan.png\" height=\"auto\" width=\"470\" data-original=\" https:\/\/zdnet2.cbsistatic.com\/hub\/i\/r\/2018\/11\/23\/83d54fee-af69-4838-9594-dbca9119e2c8\/resize\/470xauto\/56485505ef85970b0d7d1f9836f96472\/darkcomet-shodan.png\"\/><\/span><noscript><\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet2.cbsistatic.com\/hub\/i\/r\/2018\/11\/23\/83d54fee-af69-4838-9594-dbca9119e2c8\/resize\/470xauto\/56485505ef85970b0d7d1f9836f96472\/darkcomet-shodan.png\" class=\"\" alt=\"darkcomet-shodan.png\" height=\"auto\" width=\"470\"\/><\/span><\/p>\n<p><\/noscript><\/p>\n<p>The most obvious detail is that the IP address hosting this DarkComet administration panel wasn&#8217;t assigned to the infrastructure of a data center, but to a regular residential internet service provider, meaning the suspect was most likely hosting the DarkComet server on his home computer.<\/p>\n<p>Because of this operational security (OpSec) mistake, tracking the suspect&#8217;s real-world identity was most likely a piece of cake for Ukrainian police, who only needed to send a formal request to the ISP to get the man&#8217;s real name and home address.<\/p>\n<h3>More security coverage:<\/h3>\n<p>READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Suspect was most likely hosting the RAT&#8217;s command and control server on his home computer.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":20041,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-20040","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2018-11-23T12:33:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/11\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"862\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT\",\"datePublished\":\"2018-11-23T12:33:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/\"},\"wordCount\":672,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/11\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/\",\"name\":\"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/11\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg\",\"datePublished\":\"2018-11-23T12:33:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/11\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/11\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg\",\"width\":1280,\"height\":862},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/","og_locale":"en_US","og_type":"article","og_title":"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2018-11-23T12:33:00+00:00","og_image":[{"width":1280,"height":862,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/11\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT","datePublished":"2018-11-23T12:33:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/"},"wordCount":672,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/11\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/","url":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/","name":"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/11\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg","datePublished":"2018-11-23T12:33:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/11\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/11\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat.jpg","width":1280,"height":862},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ukrainian-police-arrest-hacker-who-infected-over-2000-users-with-darkcomet-rat\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Ukrainian police arrest hacker who infected over 2,000 users with DarkComet RAT"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/20040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=20040"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/20040\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/20041"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=20040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=20040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=20040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}