Published on: May 21, 2025 Updated 2 times since publishing
Jean-Pierre LESUEUR, known in the InfoSec world as DarkCoderSc, has spent over two decades immersed in the evolution of malware—first as a fascinated observer, then as a developer, and now as a preservationist. Best known for creating the infamous DarkComet RAT, LESUEUR has turned his attention to documenting the history and technical artistry behind iconic malware tools through his latest project: Malware Gallery.
More than just a digital archive, the platform combines detailed documentation, real code examples, and firsthand accounts from legendary malware authors to offer an unprecedented look at the roots of modern cybersecurity. In this SafetyDetectives interview, LESUEUR explains the passion behind the project, reflects on the ethical lessons from his past, and shares his vision for building a lasting educational resource for the security community.
Can you introduce yourself and talk about what drove you to start the Malware Gallery and what gap does it fill in the cybersecurity world?
My name is Jean-Pierre LESUEUR, though in the InfoSec community I’ve been known as DarkCoderSc since around 2007. The name DarkCoderSc originally came from a French community I created in the mid-2000s, Dark Coders of the SourCe. The term “Source” was a double reference: on one hand, it symbolized a fictional, almost mystical space where malware authors and enthusiasts could find inspiration, much like the concept of the “Source” from the Lost TV series, which I was a huge fan of at the time. On the other hand, of course, it referenced source code, making it a clever nod to both culture and code.
This anecdote is important as it highlights that I have been immersed in the world of malware for over 20 years. I’ve had the opportunity to meet, collaborate with, and contribute alongside pioneers in a field that was, at the time, reserved for a small group of passionate insiders.
Today, I am a security / malware researcher and a developer. The passion I had as a child has not only endured, it has become my job.
Malware Gallery serves as a tribute to the past, for the older generation, like myself, who had the chance to experience and contribute, in one way or another, to this fascinating era, and for the younger generation, who didn’t have that opportunity but can now discover what that world looked like.
The gallery focuses especially on Remote Access Trojans (RATs), a well-known and much-appreciated family of malware among enthusiasts. These tools were not only powerful in their use, granting stealth remote control capabilities, but also deeply interesting from a development standpoint. They touched on a wide range of domains: networking, systems programming, cryptography, evasion techniques, and performance optimization, to name a few. This category of malware is unique in that it often incorporates features from nearly all other categories, which is why it is frequently described as a framework.
To conclude, Malware Gallery exists so that people can understand, and not forget that era. Today, malware families have changed. The motivations have changed. Back then, it was about innovation, learning, experimentation, and fun. Today, it’s often about creating products for commercial or professional use or for illegal profit. As a result, modern malware tends to look and behave similarly, with only minor differences in implementation or design (with a few exceptions, it’s important to mention it). Creativity has given way to standardization.
How do you decide which malware families or tools to feature, and what does your documentation process look like when adding a new entry?
From the thousands of samples and source codes I’ve collected and archived over the past two decades, the process begins by identifying the most notable malware families. I then progressively add each release to the Malware Gallery database on my free time.
To document each sample, I use a setup involving three virtual machines. The first, called the operator, runs the malware’s graphical interface and is used to explore and document its features. I take screenshots and gather relevant details such as the author(s), affiliations, programming language(s), and other metadata. This VM runs Windows XP — the most commonly targeted operating system of that era and the platform of choice for many malware authors.
The second VM, also running Windows XP, is called the victim. It is used to trigger the malware payload and simulate a compromised system, allowing me to observe the behavior from both ends.
A third VM, running Windows 7, is occasionally used for analyzing more recent malware families that require a more modern environment. It serves the same purpose as the operator machine but supports software that doesn’t run on XP.
To streamline the documentation process, I developed a custom tool that helps manage the otherwise tedious workflow. It enables me to easily take structured screenshots of various parts of the malware GUI, categorize features, check/uncheck known capabilities, record key metadata, and track everything for future updates. This helps me work more efficiently, especially when dealing with multiple versions of the same malware family.
I plan to release this internal tool — along with its source code — when the project opens up for public contributions. I’ll attach some screenshots of the tool, in case you need it
You recently started adding explanations of malware techniques with code snippets. What’s your goal with this section, and how do you see it helping infosec professionals?
Yes! The idea of including techniques and code snippets in Malware Gallery comes from another project I co-maintain with my friend Thomas Roccia from Microsoft, called the Unprotect Project. While both projects are closely related, Unprotect focuses specifically on malware evasion techniques, the methods used to bypass security measures like antivirus software, EDRs, and firewalls. The goal there is to help malware reverse engineers and a broader range of security professionals better understand and respond to these evasive behaviors when they encounter them in the wild.
Since I couldn’t find a clean and logical way to merge Unprotect with Malware Gallery, I decided to create a separate but conceptually aligned section within Malware Gallery, extending the idea beyond showcasing malware families to also documenting the techniques they use, along with working code examples.
To clarify how this works, let me explain the relationship between features, techniques, and code snippets:
- A feature in Malware Gallery refers to a higher-level capability commonly found in malware. For example, many Remote Access Trojans (RATs) offer the ability to browse the file system, steal stored passwords, enumerate running processes, access network resources, or even prank the victim. Each of these capabilities is categorized as a “feature.”
- A technique is a more granular element. It’s the specific way a malware author implements part of a feature. For instance, enumerating network shares on a compromised machine could fall under the “Network Manager” feature but might also be used by the “File Manager” to browse remote drives. So, a single technique can serve multiple features.
- Code snippets are small, functional code samples that illustrate how each technique works. This is a key part of Malware Gallery. As with Unprotect, these code snippets are designed to help security professionals and malware analysts better understand how certain capabilities are implemented. This can improve their analysis, triage, and response processes.
Additionally, these snippets serve as a valuable learning resource. For students, researchers, or simply the curious who want to learn how malware operates, these examples provide real, practical insights into malware development and behavior.
In short, the goal is to turn Malware Gallery into more than just a historical archive, to make it an educational and technical resource for the entire infosec community.
Malware Gallery includes testimonies from original authors. How do you approach those conversations, and what value do you think their firsthand accounts add?
Great question! As I mentioned earlier, I’ve been part of the malware scene since the mid-2000s. During my learning phase and later through my active contributions, I had the privilege of meeting and interacting with some of the pioneers and most respected individuals in the malware community.
One of the most impactful encounters I had was in 2005, when I met Read101, the author of several influential projects from the late ’90s and early 2000s, such as LanFiltrator and Cyn. He was also the co-founder of Fearless Crew, one of the most prolific malware groups of the early 2000s. Read101 collaborated with many brilliant individuals, including Aphex, a developer who remains one of the most inspiring figures in the scene, I had the chance to interview Aphex recently, and I’m currently preparing a dedicated article about him, his past work, and the legacy he left behind.
Returning to Read101, shortly after we met, he became a mentor to me, in fact, he played a major role in the creation of DarkComet RAT, which wouldn’t have existed without his encouragement. He constantly pushed me to improve, shared his knowledge generously and deeply inspired me.
That was just the beginning. Over time, as I developed more experience and launched various projects, I built lasting connections with other talented and well-known malware authors. Some of those relationships are still strong today. Through these connections, I created a series called A Malware Retrospective, where I capture and share their testimonies, their words, stories, challenges, and anecdotes. It’s a way of preserving the legacy of a generation that had a profound influence on the evolution of cybersecurity, even if they are rarely acknowledged.
Many of today’s cybersecurity concepts, tools, and techniques trace their roots back to these early innovators, even if the terminology and packaging have changed. A lot of the groundwork was already being laid 20 or even 30 years ago, by individuals who were simply experimenting, learning, and pushing boundaries, not for profit, but for curiosity and the love of the craft.
Another article I’m working on features Viotto, the author of the infamous, and widely used by threat actors, Remcos RAT. While Remcos has received a lot of negative attention in recent years, what many don’t realize is that Viotto has been part of the same community since the early 2000s. Long before Remcos, he worked on a wide range of projects and was a well-known figure who, like many of us, helped shape the early malware scene. Remcos didn’t just appear out of nowhere; it came from years of evolution, experience, and learning.
So, the value of these firsthand accounts is enormous. These individuals played a crucial role in shaping what modern cybersecurity looks like today, often without recognition. Many of the tools, methods, and even concepts being studied and developed now are the direct result of their early contributions, made in a time when the motivation wasn’t money, but passion, curiosity, and the beauty of the challenge itself.
As the creator of DarkComet, how do you reflect on its legacy—both in terms of technical innovation and controversial use cases like Syria?
For more than a decade, I distanced myself from DarkComet. I stopped mentioning it publicly because I didn’t want to be defined solely by that project. I wanted people to look at my more recent work and contributions instead. DarkComet became too dominant in my image, and how that chapter ended was one of the most difficult periods of my life.
But now, 13 years later, I feel more comfortable talking about it. In fact, it’s a good time to do so in the context of Malware Gallery, since DarkComet remains one of the most well-known and remembered Remote Access Trojans (RATs) to this day, and for good reasons, both technical and historical.
Originally called SynRat, DarkComet began in 2007. It became known primarily for its incredible stability, despite offering a wide range of features. At that time, a RAT would usually be praised either for its stability or for its rich set of functionalities, but rarely for both. The two qualities often didn’t go hand in hand.
For example, Bifrost, created by KSV (a talented Swedish developer who was, interestingly, a commercial pilot in real life), was admired for its simplicity and minimalism. It only offered the core features necessary for stealth operations and was incredibly stable due to its lightweight design. On the other end of the spectrum, some RATs were packed with flashy features, which made them popular among script kiddies, but they were often buggy and unusable in real scenarios.
My goal with DarkComet was to bring both worlds together, to create a powerful, feature-rich RAT that remained stable and reliable. And importantly, it was 100% free. That unique combination is why it gained popularity so quickly, especially around 2010.
Unfortunately, that same accessibility, feature-rich, free, and reliable, also made it appealing to the wrong people, which led to it being used in Syria by the regime for surveillance and repression during the civil conflict. That event marked a turning point and ultimately led me to shut down the project.
But Syria was only the tip of the iceberg. The misuse of DarkComet by malicious actors overshadowed its technical achievements. Still, not everything that came from it was negative. That experience pushed me to become a better developer, a more responsible professional, and to connect with some of the brightest minds in the industry, including Kevin Mitnick, who used a customized version of DarkComet in some of his live demos and conferences, such as the Live Hack at CeBIT Global Conferences 2015.
At the time, many malware authors, including myself, were ahead of our time, but we didn’t fully consider the ethical implications of what we were building. Back then, this kind of development wasn’t well understood, and the concept of “responsible disclosure” or “dual-use tools” wasn’t widely discussed.
Today, the landscape is very different. Malware development is almost a mainstream interest, structured, studied, and even encouraged in academic settings as a way to better understand cyber threats. It’s no longer just underground experimentation; it’s part of cybersecurity education.
In the end, DarkComet’s legacy is complex. It was a technical success but also a personal and learning experience, one that has shaped my journey as a security researcher, developer, and contributor to the broader infosec community.
You mentioned this could evolve into a book or encyclopedia. What’s your long-term vision for Malware Gallery, and how can the community contribute or get involved?
Once I’m satisfied with the foundation, meaning a solid base of documented malware families, version releases, techniques, and code snippets. I plan to open Malware Gallery to the public. Just like we did with Unprotect Project, the idea is to allow passionate individuals to contribute by submitting their own techniques, alternative implementations of code snippets (in different languages or using different approaches), and helping to fill gaps in the existing database, whether missing versions or lesser-known malware families.
As I mentioned earlier, I’ve also developed a custom tool to simplify the documentation and contribution process. This tool will be released as open-source software, enabling contributors to easily assist with release analysis and metadata collection. Alongside that, a dedicated repository will be made available for sharing technical details, such as techniques and snippet contributions.
In the long term, my vision extends beyond the platform itself. I aim to create a physical encyclopedia, a printed archive that preserves the history, design, and code behind these iconic malware projects. It would serve as a lasting tribute to the early underground scene and the brilliant, often overlooked individuals who laid the foundation for many of today’s cybersecurity principles, including those who inspired me personally.
It’s about more than just archiving; it’s about honoring a legacy, preserving a critical part of computing history that shaped generations of future security professionals. With community support, this vision can evolve into something truly meaningful for researchers, students, and historians alike.