GINC-APT-0328 · Targeted, sponsor unknown

Packrat

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
Unknown
Motivation
Information theft and espionage
Seen
2008
Sources
6 sources carry it
Identifier
GINC-APT-0328 · packrat

What it is

A threat group that has been active for at least seven years has used malware, phishing and disinformation tactics to target activists, journalists, politicians and public figures in various Latin American countries. The threat actor, dubbed Packrat based on its preference for remote access Trojans (RATs) and because it has used the same infrastructure for several years, has been analyzed by Citizen Lab researchers John Scott-Railton, Morgan Marquis-Boire, and Claudio Guarnieri, and Cyphort researcher Marion Marschalek, best known for her extensive analysis of state-sponsored threats.

Targets

Countries
Argentina, Brazil, Ecuador, Venezuela
Sectors
Activists, Government, Journalist, Media, Political party

Tools

The tools and malware families the sources tie to it.

  • Adwind
  • Adzok
  • Archelaus Beta
  • CyberGate RAT
  • Remote Utilities
  • RemoteCMD
  • RemotePC
  • Trojan.Karagany
  • Trojan.Mebromi
  • XtremeRAT

Sources