Source: OTX
Date: 2020-10-06 15:03:04
Threat actor: PoetRAT
Affected sector: Unknown
Attack vector: Phishing
Severity: High
Confidence: Low
MITRE ATT&CK techniques: T1204,T1105,T1082
File hash (FileHash-SHA256): 208ec23c233580dbfc53aad5655845f7152ada56dd6a5c780d54e84a9d227407
Description:
"We have observed multiple new campaigns indicating a change in the actor's capabilities and showing their maturity toward better operational security. We assess with medium confidence this actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. We currently believe the malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document."