Forest Global Training Partners

Cyber Risks · Cisco Talos

PoetRAT: Malware targeting public and private sector in Azerbaijan evolves

Summary: Cisco Talos documented a new PoetRAT campaign using Word documents named "argument.doc" and "siyahı.doc" that drop a Python interpreter and the malware, with the payload now obfuscated via pyminifier using base64 and LZMA compression and split across files including a "Constant.py" holding the C2 server and configuration. The new version switched file transfer from FTP to HTTP, and a later document saved six days after Azerbaijan's partial mobilization decree executes a macro that creates a ZIP containing a Lua script and luajit to download further payloads.

Bottom line: The operators reached sensitive material including diplomatic passports belonging to Azerbaijani citizens, and the shift to HTTP for exfiltration means the traffic blends with the most common protocol on your network rather than standing out.

Read the original at Cisco Talos ↗

Topics
Malware
Related