New PoetRAT Hits Energy Sector With Data-Stealing Tools

guest · Apr 16, 2020

New PoetRAT Hits Energy Sector With Data-Stealing Tools
A never-before-seen RAT is targeting Azerbaijan energy companies
April 16, 2020
https://threatpost.com/new-poetrat-hits-energy-sector-with-data-stealing-tools/154876/

A never-before-seen remote access trojan (RAT) has been discovered in a set of campaigns targeting the energy sector, with a slew of post-exploitation tools to log keystrokes, record footage from webcams and steal browser credentials.

Researchers called the malware “PoetRAT” due to various references to sonnets by English playwright William Shakespeare throughout the macros, which was embedded in malicious Word documents that were part of the campaign. Further analysis of the RAT and its distribution reveals a carefully planned, highly targeted campaign against public and the private Azerbaijan sectors as well as SCADA systems.

“We observed an actor using multiple tools and methodologies to carry out their full attack chain,” Warren Mercer, Paul Rascagneres and Vitor Ventura with Cisco Talos, in a Thursday analysis.
Click to expand...

The RAT
For all of these documents, once the macros are enabled, a Visual Basic script dropper is executed. The script loads its own document into memory, which is a ZIP file (“smile.zip”) that contains a Python interpreter, as well as a Python script that is the RAT.

“We saw the almost exclusive use of Python for the attacker, to the point where they brought the whole interpreter with them to their victim machines,” Mercer told Threatpost. ‘This is quite interesting because Python executions are generally not under the same scrutiny as, say, Powershell, but it can have equally damaging impacts on your environment.”
Click to expand...

guest · Oct 8, 2020

“PoetRAT” Is Targeting Key Organizations and the Public Sector in Azerbaijan
A new version of the PoetRAT is currently being deployed against Azerbaijani organizations
October 7, 2020
https://www.technadu.com/poetrat-targeting-key-organizations-public-sector-azerbaijan/216653/

Cyberwarfare is now an integral part of any military conflict, and the ongoing clashes between Azerbaijan and Armenia create the conditions for higher rates of malware deployment. Cisco Talos researchers have identified a new variant of the “PoetRAT,” which is being deployed against the public sector of Azerbaijan, as well as various key organizations in the country.

Cisco has been following the particular actors and the specific tool in the past few months, and they have noticed some changes in the most recent versions. Most notably, the hackers have improved their operational security, as they now perform more analytical reconnaissance on their targets.
Click to expand...

Talos confirms that the attackers have already managed to access sensitive networks and data in Azerbaijan, so the campaign has been very effective so far. Unfortunately, though, the researchers couldn’t discern any details about the source of the attacks and who could be hiding behind them.
Click to expand...

Cisco Talos: PoetRAT: Malware targeting public and private sector in Azerbaijan evolves

The Azerbaijan public sector and other important organizations are still targeted by new versions of PoetRAT.

This actor leverages malicious Microsoft Word documents alleged to be from the Azerbaijan government.

The attacker has moved from Python to Lua script.

Click to expand...

Same victimology
As with the previous campaigns, the targets of the new campaigns are linked to Azerbaijan. In the previous campaigns, the attacker was mainly interested in the energy sector, more specifically those involved with wind turbines.

The attacker is still attracted to VIPs and the public sector. In the recent campaign we identified the attacker had access to sensitive information, such as diplomatic passports belonging to citizens of Azerbaijan.
CONCLUSION
The malware slightly evolved since our previous publication. The developer implemented a new exfiltration protocol to hide its activities. There's also additional obfuscation to avoid detection based on strings or signatures.
The attacker obtained access to sensitive documents from the compromised systems, even if the technical aspects are not as evolved as expected in this kind of context and targeted attacks.
Click to expand...

Log in or Sign up

New PoetRAT Hits Energy Sector With Data-Stealing Tools

guest Guest

guest Guest

Log in or Sign up

New PoetRAT Hits Energy Sector With Data-Stealing Tools

guest Guest

guest Guest

Useful Searches