Threat intelligence / Malware

PoetRAT

[PoetRAT](https://attack.mitre.org/software/S0428) is a remote access trojan (RAT) that was first identified in April 2020. [PoetRAT](https://attack.mitre.org/software/S0428) has been used in multiple campaigns against the private and public sectors in Azerbaijan, including ICS and SCADA systems in the energy sector. The STIBNITE activity group has been observed using the malware. [PoetRAT](https://attack.mitre.org/software/S0428) derived its name from references in the code to poet William Shakespeare. (Citation: Talos PoetRAT April 2020)(Citation: Talos PoetRAT October 2020)(Citation: Dragos Threat Report 2020)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Labels

malware

35 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Automated Collection

Technique

uses

to Command Obfuscation

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Dynamic Data Exchange

Technique

uses

to Exfiltration Over Alternative Protocol

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to File Transfer Protocols

Technique

uses

to Hidden Files and Directories

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Keylogging

Technique

uses

to LSASS Memory

Technique

uses

to Lua

Technique

uses

to Malicious File

Technique

uses

to Modify Registry

Technique

uses

to Non-Standard Port

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Python

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote System Discovery

Technique

uses

to Screen Capture

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Video Capture

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

4 external

References

mitre-attack

S0428

open

Dragos Threat Report 2020

https://hub.dragos.com/hubfs/Year-in-Review/Dragos_2020_ICS_Cybersecurity_Year_In_Review.pdf?hsCtaTracking=159c0fc3-92d8-425d-aeb8-12824f2297e8%7Cf163726d-579b-4996-9a04-44e5a124d770

open

Talos PoetRAT April 2020

https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html

open

Talos PoetRAT October 2020

https://blog.talosintelligence.com/2020/10/poetrat-update.html

open