Source: OTX
Date: 2020-10-06 15:03:04
Threat actor: PoetRAT
Affected sector: Unknown
Attack vector: Phishing
Severity: High
Confidence: Low
MITRE ATT&CK techniques: T1204,T1105,T1082
File hash (FileHash-SHA256): a703dc8819dca1bc5774de3b6151c355606e7fe93c760b56bc09bcb6f928ba2d
Description:
"We have observed multiple new campaigns indicating a change in the actor's capabilities and showing their maturity toward better operational security. We assess with medium confidence this actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. We currently believe the malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document."