Threat actor abuses Gophish to deliver new PowerRAT and DCRAT
Summary: Cisco Talos reports a threat actor targeting Russian-speaking users with phishing emails sent from an AWS EC2 instance (34[.]236[.]234[.]165) running the open-source Gophish toolkit on port 3333, luring victims with a masqueraded VK social media page. Two attack chains deliver payloads: a malicious Word document with a hidden base64 blob that drops an HTA and PowerShell loader via the HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LOAD registry key to run a new PowerShell RAT called PowerRAT, and HTML files with embedded JavaScript that download a 7-Zip archive masquerading as the VK messenger to install DCRAT through a GOLoader that adds C:\ and the desktop folder to Microsoft Defender exclusions.
What you should know: The actor used Gophish, a legitimate security-awareness training tool, as the delivery infrastructure, and the PowerRAT includes an offlineworker() fallback that keeps the infection alive even when C2 traffic is blocked, with C2 servers hosted in Russia at 94[.]103[.]85[.]47 and 5[.]252[.]176[.]55.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026