LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0428: PoetRAT

PoetRAT is a remote access trojan (RAT) that was first identified in April 2020. PoetRAT has been used in multiple campaigns against the private and public sectors in Azerbaijan, including ICS and SCADA systems in the energy sector. The STIBNITE activity group has been observed using the malware. PoetRAT derived its name from references in the code to poet William Shakespeare. [1][2][3]

EnterpriseS0428MalwareObject v2.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

PoetRAT is a Windows remote access trojan documented by ATT&CK as used in campaigns against public and private sector organizations in Azerbaijan, including ICS and SCADA systems in the energy sector. For defenders, the material issue is not just the malware name; its related behaviors include credential access, discovery, collection, command execution, file transfer, command-and-control, and exfiltration. That combination can turn one compromised Windows host into an identity, data-loss, and operational-resilience problem, especially where enterprise IT connects to sensitive operational environments.

Executive priority

Prioritize this as a readiness and evidence question: can the organization prove it would see and contain a Windows RAT that dumps or captures credentials, inventories systems and users, collects screenshots/video/files, modifies the registry, deletes files, and communicates over web or file-transfer protocols? Energy, industrial, and public-sector environments should also validate segmentation and incident response handoffs between enterprise SOC and OT/ICS stakeholders, because the official description references ICS/SCADA targeting in the energy sector.

Technical view

ATT&CK provides no official detection text for PoetRAT, so coverage should be validated through the related techniques rather than a single signature. SOC and detection teams should test visibility for LSASS memory access, keylogging indicators, screen/video capture, automated collection, process/user/system/file discovery, Windows command shell execution, Visual Basic/Python/Lua execution, registry modification, file deletion, ingress tool transfer, C2 over web and file-transfer protocols, and exfiltration over C2 or alternate protocols. Correlation matters: isolated discovery or scripting may be benign, but discovery plus credential access, collection, unusual outbound traffic, and cleanup behavior should raise priority.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Script/interpreter execution records for cmd, Visual Basic, Python, and Lua where present
  • LSASS access and credential-dumping prevention or alert telemetry
  • Registry modification events
  • File creation, transfer, archive-like staging, and deletion events

Detection direction

  • Build behavior-based coverage around the ATT&CK relationships; do not rely on the malware family name alone.
  • Correlate execution, discovery, credential access, collection, outbound communication, and file cleanup into higher-confidence cases.
  • Tune for legitimate administrative activity, software inventory, remote support, scripting, and backup/file-transfer workflows to reduce false positives.
  • Validate whether Windows endpoints actually log command lines, registry changes, LSASS access, file deletion, and outbound network destinations with sufficient retention for incident response.
  • Pay special attention to environments where enterprise Windows hosts can reach operational, ICS, SCADA, or energy-sector systems, since segmentation gaps can make RAT activity more consequential.

Mitigation priorities

  • Reduce credential exposure first: enforce least privilege, protect LSASS where feasible, and limit administrative rights on Windows endpoints.
  • Restrict unnecessary scripting and interpreter use, including Python, Lua, Visual Basic, and command shell abuse, using approved execution controls.
  • Harden egress paths by monitoring and controlling web and file-transfer protocols rather than assuming common protocols are safe.
  • Use application control and endpoint hardening to limit unauthorized tool transfer, registry persistence or modification, and post-compromise utilities.
  • Strengthen segmentation and incident playbooks between enterprise IT and ICS/SCADA environments where relevant.
Additional notes and limits

The strongest defensive value comes from mapping PoetRAT to its ATT&CK relationships: credential access, discovery, execution, collection, C2, exfiltration, and stealth behaviors. The official object identifies Windows as the malware platform and references campaigns against Azerbaijan, including ICS/SCADA energy-sector systems, and notes STIBNITE has been observed using the malware. Local risk should be based on exposure, Windows endpoint visibility, identity controls, egress monitoring, and IT/OT architecture.

ATT&CK does not provide official detection guidance, aliases, labels, or explicit tactics for this malware object. The related techniques are behavior context, not proof of current activity in any environment. This take does not include indicators of compromise or claim active exploitation, customer exposure, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

PoetRAT

PoetRAT is a remote access trojan (RAT) that was first identified in April 2020. PoetRAT has been used in multiple campaigns against the private and public sectors in Azerbaijan, including ICS and SCADA systems in the energy sector. The STIBNITE activity group has been observed using the malware. PoetRAT derived its name from references in the code to poet William Shakespeare. [1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

35 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.[1]

EnterpriseT1041Exfiltration Over C2 Channel

PoetRAT has exfiltrated data over the C2 channel.[2]

EnterpriseT1071.002File Transfer ProtocolsSub-technique

PoetRAT has used FTP for C2 communications.[2]

EnterpriseT1027.010Command ObfuscationSub-technique

PoetRAT has `pyminifier` to obfuscate scripts.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

PoetRAT has called cmd through a Word document macro.[2]

EnterpriseT1048Exfiltration Over Alternative Protocol

PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.[1]

EnterpriseT1204.002Malicious FileSub-technique

PoetRAT has used spearphishing attachments to infect victims.[1]

EnterpriseT1571Non-Standard Port

PoetRAT used TLS to encrypt communications over port 143[1]

EnterpriseT1112Modify Registry

PoetRAT has made registry modifications to alter its behavior upon execution.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

PoetRAT was distributed via malicious Word documents.[1]

EnterpriseT1083File and Directory Discovery

PoetRAT has the ability to list files upon receiving the ls command from C2.[1]

EnterpriseT1105Ingress Tool Transfer

PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.[1][2]

EnterpriseT1564.001Hidden Files and DirectoriesSub-technique

PoetRAT has the ability to hide and unhide files.[1]

EnterpriseT1119Automated Collection

PoetRAT used file system monitoring to track modification and enable automatic exfiltration.[1]

EnterpriseT1125Video Capture

PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.[1]

EnterpriseT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique

PoetRAT has used ftp for exfiltration.[1]

EnterpriseT1497.001System ChecksSub-technique

PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.[1]

EnterpriseT1018Remote System Discovery

PoetRAT used Nmap for remote system discovery.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

PoetRAT has used HTTP and HTTPs for C2 communications.[2]

EnterpriseT1082System Information Discovery

PoetRAT has the ability to gather information about the compromised host.[1]

EnterpriseT1559.002Dynamic Data ExchangeSub-technique

PoetRAT was delivered with documents using DDE to execute malicious code.[1]

EnterpriseT1003.001LSASS MemorySub-technique

PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.[1]

EnterpriseT1057Process Discovery

PoetRAT has the ability to list all running processes.[1]

EnterpriseT1059.005Visual BasicSub-technique

PoetRAT has used Word documents with VBScripts to execute malicious activities.[1][2]

EnterpriseT1573.002Asymmetric CryptographySub-technique

PoetRAT used TLS to encrypt command and control (C2) communications.[1]

EnterpriseT1059.006PythonSub-technique

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.[1]

EnterpriseT1113Screen Capture

PoetRAT has the ability to take screen captures.[1][3]

EnterpriseT1140Deobfuscate/Decode Files or Information

PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.[2]

EnterpriseT1027Obfuscated Files or Information

PoetRAT has used a custom encryption scheme for communication between scripts.[1]

EnterpriseT1059.011LuaSub-technique

PoetRAT has executed a Lua script through a Lua interpreter for Windows.[2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

PoetRAT has added a registry key in the hive for persistence.[1]

EnterpriseT1070.004File DeletionSub-technique

PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.[1]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.[1]

EnterpriseT1560.001Archive via UtilitySub-technique

PoetRAT has the ability to compress files with zip.[1]

EnterpriseT1056.001KeyloggingSub-technique

PoetRAT has used a Python tool named klog.exe for keylogging.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1071.002: File Transfer ProtocolsEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1048: Exfiltration Over Alternative ProtocolEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1571: Non-Standard PortEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1564.001: Hidden Files and DirectoriesEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1125: Video CaptureEnterpriseuses · TechniqueT1048.003: Exfiltration Over Unencrypted Non-C2 ProtocolEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1559.002: Dynamic Data ExchangeEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1059.005: Visual BasicEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.3
Created
Modified
Raw hash
a02b79418edb640d...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.3Current bundlea02b79418edb…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  2. [2]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  3. [3]
    Dragos Threat Report 2020

    Dragos. (n.d.). ICS Cybersecurity Year in Review 2020. Retrieved February 25, 2021.

    Open source URL
  4. [4]
    Dragos Threat Report 2020

    Dragos. (n.d.). ICS Cybersecurity Year in Review 2020. Retrieved February 25, 2021.

    Open source URL
  5. [5]
    Dragos Threat Report 2020

    Dragos. (n.d.). ICS Cybersecurity Year in Review 2020. Retrieved February 25, 2021.

    Open source URL
  6. [6]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  7. [7]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  8. [8]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  9. [9]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  10. [10]
    mitre-attackS0428
    Open source URL
  11. [11]
    mitre-attackS0428
    Open source URL
  12. [12]
    mitre-attackS0428
    Open source URL
  13. [13]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  14. [14]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  15. [15]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  16. [16]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  17. [17]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  18. [18]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  19. [19]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  20. [20]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  21. [21]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  22. [22]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  23. [23]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  24. [24]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  25. [25]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  26. [26]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  27. [27]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  28. [28]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  29. [29]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  30. [30]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  31. [31]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  32. [32]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  33. [33]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  34. [34]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  35. [35]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  36. [36]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  37. [37]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  38. [38]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  39. [39]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  40. [40]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  41. [41]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  42. [42]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  43. [43]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  44. [44]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  45. [45]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  46. [46]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  47. [47]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  48. [48]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  49. [49]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  50. [50]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  51. [51]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  52. [52]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  53. [53]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  54. [54]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  55. [55]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  56. [56]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  57. [57]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  58. [58]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  59. [59]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  60. [60]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  61. [61]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  62. [62]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  63. [63]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  64. [64]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  65. [65]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  66. [66]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  67. [67]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  68. [68]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  69. [69]
    Dragos Threat Report 2020

    Dragos. (n.d.). ICS Cybersecurity Year in Review 2020. Retrieved February 25, 2021.

    Open source URL
  70. [70]
    Dragos Threat Report 2020

    Dragos. (n.d.). ICS Cybersecurity Year in Review 2020. Retrieved February 25, 2021.

    Open source URL
  71. [71]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  72. [72]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  73. [73]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  74. [74]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  75. [75]
    Talos PoetRAT October 2020

    Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.

    Open source URL
  76. [76]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  77. [77]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  78. [78]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  79. [79]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  80. [80]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use