Source: OTX
Date: 2020-10-06 15:03:04
Threat actor: PoetRAT
Affected sector: Unknown
Attack vector: Phishing
Severity: High
Confidence: Low
MITRE ATT&CK techniques: T1204,T1105,T1082
File hash (FileHash-SHA256): e4e99dc07fae55f2fa8884c586f8006774fe0f16232bd4e13660a8610b1850a2
Description:
"We have observed multiple new campaigns indicating a change in the actor's capabilities and showing their maturity toward better operational security. We assess with medium confidence this actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. We currently believe the malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document."