Poco RAT Burrows Deep Into Mining Sector

Unidentified attackers are running a Spanish-language phishing campaign targeting primarily Latin American mining and manufacturing organizations to distribute Poco RAT, a Delphi-built credential-stealing remote access trojan that uses Google Drive-hosted 7zip payloads, POCO C++ libraries for evasion, persists via registry and launches grpconv.exe, communicates with a static C2 (94.131.119.126) on ports 6541–6543 and restricts responses to victims geolocated in Latin America; Cofense researchers provide IOCs and recommend blocking Google Drive links, monitoring grpconv.exe execution, and blocking the known C2.