Loading malware…
Poco RAT is a remote access trojan used in campaigns targeting Spanish-speaking organizations and users in Latin America. Reported targeting has included the mining sector, as well as government and private-sector entities in the region. The malware has been associated with Dark Caracal, also referred to as Darkling APT, in cyber-espionage activity aligned with intelligence collection objectives.
Observed delivery commonly relies on phishing emails carrying malicious PDF attachments. These lures redirect victims to download additional staged content, including archive-like files retrieved from legitimate file-sharing services, which then execute droppers that install the Poco RAT payload. Financial-themed phishing has also been linked to its deployment.
Once installed, Poco RAT provides remote control over compromised Windows systems. Documented capabilities include command execution and collection of system information from infected endpoints, enabling follow-on post-compromise activity. Its use in Spanish-language phishing ecosystems and repeated association with targeted intrusion activity indicate a role as an operator-controlled access malware family rather than commodity mass-market malware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A new campaign distributing Poco RAT to Spanish-speaking users in Latin America has been reported in the wild.
A new campaign distributing Poco RAT to Spanish-speaking users in Latin America has been reported in the wild.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan delivered through financial-themed phishing in cyber espionage activity.
Remote access trojan with espionage features (e.g., file upload, screenshots) used by Dark Caracal against Spanish-speaking enterprises in Latin America.
Remote Access Trojan (RAT) used by Dark Caracal for espionage, often delivered via phishing and fileless techniques.
Remote access trojan delivered via phishing emails with malicious PDF attachments that redirect victims to .rev downloads and droppers, ultimately infecting endpoints and giving attackers remote control, command execution, and system information collection capabilities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.