Packrat

Executive Summary

Packrat, a long-active threat actor targeting individuals in Latin America, primarily uses malware, phishing, and disinformation tactics. The group has been operational for at least seven years, focusing on activists, journalists, politicians, and public figures. Their activities suggest a strategic focus on influencing political dynamics and gathering sensitive information.

Goals & Targeting

Packrat's strategic objectives appear to be tied to political manipulation, information gathering, and undermining the credibility of targeted individuals or institutions. The group's targeting profile focuses on individuals with high public visibility or influence, such as journalists, politicians, and activists, particularly in Latin American countries. This suggests a desire to shape public opinion, disrupt governance, or gain access to sensitive information.

Packrat is a sophisticated cyber threat actor that has operated for over seven years, primarily targeting high-profile individuals in Latin America. The group specializes in using remote access Trojans (RATs), phishing campaigns, and disinformation tactics to compromise its victims. Packrat's activities have been extensively studied by researchers such as Citizen Lab and Cyphort, who have identified the group's long-term use of stationary infrastructure and its focus on politically sensitive targets. The threat actor's campaigns often involve spear-phishing emails with malicious attachments or links, aiming to infect devices and establish persistent access for surveillance or data exfiltration. Packrat’s operations demonstrate a high level of operational security and persistence, making it a significant concern for governments, media organizations, and activists in the region.

Key Capabilities

• Use ofRemote Access Trojans (RATs)
• Spear-phishing campaigns with malicious attachments
• Disinformation tactics
• Long-term infrastructure persistence
• Targeted malware deployment

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Packrat has demonstrated a consistent operational pattern over the years, with a focus on long-term campaigns and targeted attacks. The group's use of stationary infrastructure and persistent access techniques indicates a patient and methodical approach. Notable past operations include numerous phishing campaigns targeting activists and public figures in Ecuador and other Latin American countries. Packrat's ability to remain active for over seven years underscores its resilience and operational effectiveness.

IOC Patterns

• Spear-phishing emails with malicious Office attachments
• Malware-infected domains such as daynews.sytes.net and taskmgr.serveftp.com
• MD5 hashes linked to their malware payloads (e.g., ea7bcf58a4ccdecb0c64e56b9998a4ac)
• Cobalt Strike-like C2 domains

Recommended Actions

• Implement rigorous user training on phishing and social engineering tactics
• Monitor network traffic for known Packrat-related domains and IP addresses
• Use endpoint detection and response (EDR) tools to detect RAT activity
• Adopt strong email filtering solutions to block malicious attachments
• Perform regular security audits to identify potential compromises

Suggested Tags