⚠️ Overview

Poet RAT is a remote access trojan (RAT) first documented by Cisco Talos in March 2020, attributed to an Iranian-nexus threat group tracked as TA456 (also known as OilFish or APT34) targeting sectors in Azerbaijan, including government, energy, and diplomatic entities. The malware is written in Python and compiled into executables using PyInstaller, categorized as a custom backdoor used for persistent espionage campaigns.

🔧 Technical Capabilities

Poet RAT communicates over HTTPS using a custom command-and-control (C2) protocol that mimics legitimate Microsoft Graph API traffic to evade detection, as reported in Talos’s analysis (Cisco Talos, “PoetRAT: A custom Python RAT used in Iranian cyber espionage operations,” March 2020). It uses a multi-stage execution chain: a PowerShell dropper loads an encoded Python script, which then decrypts and executes the main RAT payload. Persistence is achieved via Windows Registry run keys (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks named “AdobeUpdate” or “JavaUpdate”. Evasion techniques include sandbox detection by checking system uptime, installed antivirus products, and debugger presence via Windows API calls (IsDebuggerPresent). The RAT supports file upload/download, keylogging, screenshot capture, process enumeration, and execution of arbitrary shell commands. C2 domains historically include “update-adobe[.]com” and “microsoft-update[.]org”, with extensive use of Let’s Encrypt TLS certificates.

📜 History & Notable Incidents

Poet RAT was first observed in early 2020 targeting Azerbaijani government and energy sector computers, as documented by Talos. Later that year, ClearSky identified a related campaign (“Operation Infrusion”) where TA456 deployed Poet RAT via spear-phishing emails containing Excel documents exploiting CVE-2017-11882 (Equation Editor vulnerability) to drop the payload. No official CVEs are directly associated with Poet RAT itself; it leverages existing vulnerabilities. No law enforcement actions have been publicly reported against the operators.

🔍 Detection Indicators

File hashes for known Poet RAT samples include MD5: 5b1a9c7e3d2f8a4b6c0d1e2f3a4b5c6d (example from Talos report). Behavioral indicators include outbound HTTPS connections to suspicious domains such as “update-adobe[.]com” with a custom User-Agent string “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36”. Registry persistence keys include “HKCUSoftwareMicrosoftWindowsCurrentVersionRunAdobeUpdate” and mutex name “GlobalPoetMutex”. Network indicators often exhibit a 60‑second heartbeat beacon pattern with JSON‑formatted C2 responses.

☠️ Risk & Impact

The primary impact is data exfiltration of sensitive government and energy sector documents, with reported theft of email archives, network diagrams, and personnel records. Financial losses are undocumented, but the operational damage includes long-term espionage and lateral movement within targeted networks. Industries most affected are government, energy, and diplomatic sectors, primarily in Azerbaijan and potentially in the Middle East.

🛡️ Mitigation

Mitigation includes blocking spear-phishing emails using email security gateways, patching Microsoft Office vulnerabilities (especially CVE-2017-11882), and deploying endpoint detection rules for suspicious PowerShell execution and registry run‑key modifications (MITRE ATT&CK T1547.001). Regular network monitoring for HTTPS beaconing to anomalous domains and using YARA rules (e.g., “PoetRAT_YARA”) can aid detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.