Loading story…
Dragos identified STIBNITE as an intrusion group targeting government and industrial organizations in Azerbaijan, including wind generation entities, in operations spanning late 2019 through 2020. The activity focused on early-stage compromise in IT environments rather than confirmed operational disruption, with attackers seeking initial access, credential theft, and network reconnaissance that could later enable movement toward ICS and OT networks. Dragos linked the campaign to regional geopolitical tensions and noted the targeting as unusual because the Caucasus has seen comparatively limited public reporting on ICS-focused intrusions.
The group used spoofed Azerbaijani government credential-harvesting sites, spearphishing emails carrying malicious Microsoft Office documents, and the custom PoetRAT malware for collection and remote command execution. Cisco Talos separately documented PoetRAT using COVID-19-themed lures against Azerbaijan’s public and private sectors, reinforcing the malware’s role in the campaign. Additional tooling included PypyKatz and LaZagne for credential theft, while command-and-control infrastructure relied on DDNS-backed services and reused infrastructure across multiple 2020 operations.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Dragos disclosed STIBNITE as one of four new ICS/OT threat activity groups in its ICS Cybersecurity 2020 Year in Review reporting. The company said the group had targeted Azerbaijani government and wind generation organizations and was explicitly attempting to gain access to ICS networks and operations.
Cisco Talos reported a PoetRAT campaign using COVID-19-themed lures to target public and private sector entities in Azerbaijan. Dragos later associated PoetRAT with STIBNITE's intrusion activity.
Dragos found that STIBNITE reused infrastructure across its campaigns during 2020, alongside use of credential theft sites, spearphishing, PoetRAT, PypyKatz, and LaZagne. The activity remained concentrated in IT environments, though Dragos assessed it could support later ICS compromise.
Dragos reported that STIBNITE conducted multiple intrusion operations beginning in late 2019 against government and wind generation entities in Azerbaijan. The activity focused on initial access, credential theft, and information gathering consistent with Stage 1 of the ICS Cyber Kill Chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported that Chinese-speaking threat actor **UAT-10147** targeted vulnerable internet-facing **Windows IIS** and **Linux** servers worldwide, using publicly disclosed one-day flaws to gain access and then deploying a broad post-compromise toolkit tied to **SEO fraud** and data theft. Talos said the group used AI-assisted workflows to automate reconnaissance, exploit validation, payload deployment, persistence, and operational documentation, and maintained infrastructure suggesting significant scale, including a target list of roughly **170,000 URLs**. On compromised Windows systems, the actor used batch scripts, scheduled tasks, rogue user creation, **EfsPotato**, and Defender exclusions; on Linux, it relied on web shells and local privilege-escalation exploits to obtain root access. A central payload in the campaign was **SPECTRE**, a custom cross-platform backdoor for Windows and Linux that supports HTTP-based command and control, anti-analysis, process injection, credential access, and on Windows a **BYOVD** technique to reduce EDR visibility by unlinking kernel callbacks. On Linux, SPECTRE deployed a rootkit called **Specter**, disguised as `acpi_pad.ko` and persisted through a fraudulent systemd service to hide processes and modules and elevate privileges. Talos also observed **Noodle RAT**, **QuasarRAT**, **Gh0stCringe**, **Meterpreter**, and web shells in the same operations; prior research has linked Noodle RAT variants to multiple Chinese-speaking espionage and financially motivated clusters, including Linux samples that copy themselves to `/tmp/CCCCCCCC`, decrypt configuration with RC4 using the hardcoded key `r0st@#$`, and connect to attacker-controlled C2 servers.
Aug 28, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026
Hunt.io identified a 13-server suspected command-and-control cluster associated with **SpiceRAT** targeting government, telecommunications, and energy organizations across Uzbekistan, Turkmenistan, Tajikistan, Kyrgyzstan, and Kazakhstan. The servers impersonated regional government agencies, telecom providers, and energy entities, using cloned RTX Corporation web content alongside shared domains, TLS certificates, registration relationships, and recurring hosting patterns. Researchers expanded the SilkParasite-linked infrastructure by pivoting from a shared page hash and TLS certificate, finding overlaps with infrastructure previously reported for **NodeEdgeRAT** and **NomadRAT**. Passive-DNS records indicate related subdomains may extend to mid-2022, but the findings are infrastructure-based rather than evidence of confirmed intrusions or malware-sample linkage; they support either a common operator or shared support infrastructure, without definitive attribution.
Sep 17, 2026