Source: OTX
Date: 2020-10-06 15:03:04
Threat actor: PoetRAT
Affected sector: Unknown
Attack vector: Phishing
Severity: High
Confidence: Low
MITRE ATT&CK techniques: T1204,T1105,T1082
File hash (FileHash-SHA256): dc565146cd4ecfb45873e44aa1ea1bac8cfa8fb086140154b429ba7274cda9a2
Description:
"We have observed multiple new campaigns indicating a change in the actor's capabilities and showing their maturity toward better operational security. We assess with medium confidence this actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. We currently believe the malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document."