Threat actor abuses Gophish to deliver new PowerRAT and DCRAT

Cisco Talos reports an active Gophish-based phishing campaign targeting Russian-speaking users that uses malicious Word macros and JavaScript-embedded HTML to deliver a memory-resident PowerShell RAT (PowerRAT) and Dark Crystal RAT (DCRAT). The report details delivery URLs and IPs, infection and persistence mechanisms (registry LOAD key, scheduled tasks, Defender exclusions), loader behaviors (GOLoader, SFXRAR), C2 endpoints, modular payload capabilities including data theft and remote control, and provides IOCs and detection guidance.