Source: OTX
Date: 2020-10-06 15:03:04
Threat actor: PoetRAT
Affected sector: Unknown
Attack vector: Phishing
Severity: High
Confidence: Low
MITRE ATT&CK techniques: T1204,T1105,T1082
File hash (FileHash-SHA256): 64aeffe15aece5ae22e99d9fd55657788e71c1c52ceb08e3b16b8475b8655059
Description:
"We have observed multiple new campaigns indicating a change in the actor's capabilities and showing their maturity toward better operational security. We assess with medium confidence this actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. We currently believe the malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document."