BROADCASTS.com

Cisco Talos discovered PoetRAT earlier this year. Since then, they observed multiple new campaigns indicating a change in the actor's capabilities and showing their maturity toward better operational security. They assess with medium confidence this actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. They currently believe the malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document. These Word documents continue to contain malicious macros, which in turn download additional payloads once the attacker sets their sites on a particular victim. As the geopolitical tensions grow in Azerbaijan with neighboring countries, this is no doubt a stage of espionage with national security implications being deployed by a malicious actor with a specific interest in various Azerbajiani government departments.\nJoining us in this week's Research Saturday to discuss the research from Cisco's Talos Outreach is Craig Williams.\nThe research can be found here:\xa0\nPoetRAT: Malware targeting public and private sector in Azerbaijan evolves\n\nLearn more about your ad choices. Visit megaphone.fm/adchoices