PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors
Summary: Cisco Talos detailed a campaign it calls PoetRAT, in which a malicious Word document named "C19.docx" or "Azerbaijan_special.doc" drops a ZIP file containing a Python interpreter and scripts that run a remote access trojan. The operators used COVID-19-themed lures, a phishing site mimicking Azerbaijan government webmail at gov-az[.]herokuapp[.]com, and tools including keyloggers, browser password stealers, Mimikatz and pypykatz, camera capture via OpenCV, and a file watcher that exfiltrates data by email or FTP.
Why it matters: Talos assesses the adversaries may have been after credentials from officials in Azerbaijan's government, and the RAT's use of Python may let it slip past tools that whitelist Python execution.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026