Full Report
The attackers use PoetRAT, a new RAT Trojan distributed via Microsoft Word documents
Analysis Summary
Based on the information provided regarding the **PoetRAT** campaigns, here is the structured threat intelligence summary.
# Threat Actor: Unknown (Associated with PoetRAT)
## Attribution & Identity
* **Actor Identification:** Currently unattributed to a specific known nation-state group (e.g., APT).
* **Aliases:** No specific alias has been assigned to the group itself, though the activity is uniquely identified by the use of **PoetRAT**.
* **Known Associations:** The actor is characterized by a specific interest in Azerbaijan, using lures related to government and defense sectors.
## Activity Summary
* **Recent Campaigns:** Several waves of malicious activity were observed in early 2020. The campaigns utilized spear-phishing emails with malicious Microsoft Word document attachments to deploy PoetRAT.
* **Operations:** The actor frequently uses "bait" documents related to the Azerbaijani government, military procurement, or regional security issues to entice victims into enabling macros.
## Tactics, Techniques & Procedures
* **Initial Access:** Phishing/Spear-phishing via malicious attachments (Microsoft Word documents).
* **Execution:** Use of malicious VBA Macros within Office documents to drop scripts.
* **Persistence:** Use of scheduled tasks or registry run keys to maintain presence.
* **Defense Evasion:** Use of legitimate document templates to lower suspicion; code obfuscation in the Python-based RAT.
* **Collection:** Automated exfiltration of files (specifically `.docx`, `.pdf`, `.xls`) from the infected system to C2.
* **MITRE ATT&CK IDs:**
* T1566 (Phishing)
* T1059.005 (Command and Scripting Interpreter: Visual Basic)
* T1041 (Exfiltration Over C2 Channel)
## Targeting
* **Sectors:** Civil government, defense, and industrial organizations (SCADA/Industrial control system-related entities).
* **Geography:** Primarily **Azerbaijan**.
* **Victims:** Government officials, military contractors, and personnel within industrial energy sectors.
## Tools & Infrastructure
* **Malware Families:**
* **PoetRAT:** A Remote Access Trojan written in Python. It includes features for file uploading/downloading, command execution, and taking screenshots.
* **Infrastructure:**
* C2: The actor typically uses compromised legitimate websites or dedicated VPS to host C2 servers.
* **Defanged Examples:**
* C2 Domains: `karyagdi[.]io`, `109[.]248[.]150[.]7`
## Implications
* **Strategic Assessment:** This actor represents a focused espionage threat to Azerbaijan. Their interest in industrial organizations suggests a goal of mapping critical infrastructure or stealing sensitive intellectual property and tactical defense communications.
* **Threat Level:** Moderate-High for organizations operating within the Caucasus region.
## Mitigations
* **Macro Security:** Disable Office Macros via Group Policy or set them to "Disable all macros with notification."
* **Email Filtering:** Implement robust attachment scanning to identify and block suspicious `.doc` and `.zip` files.
* **Endpoint Monitoring:** Monitor for suspicious Python execution or unusual outbound connections to unauthorized IPs/domains.
* **User Training:** Conduct specific Phishing awareness training focusing on lures related to regional government and military news.