Amnesia RAT deployed in multi-stage phishing attacks against Russian users

FortiGuard Labs uncovered a multi-stage phishing campaign targeting Russian users that uses fake business documents to trick victims into running a PowerShell loader (kira.ps1) which downloads additional obfuscated scripts from GitHub/Dropbox; the attack culminates in deployment of Amnesia RAT for broad data theft and persistence and Hakuna Matata ransomware/WinLocker for encryption and extortion, while disabling Microsoft Defender and exfiltrating data via Telegram and cloud file hosts.