Governmental Organizations are Targeted by Netwire RAT

Zscaler ThreatLabz observed a targeted spearphishing campaign delivering NetwireRAT to Pakistani government and other sector recipients via macro-enabled .docm attachments; the macro decodes a URL pointing to a compromised Nepalese college site, uses PowerShell to fetch and execute the Netwire payload which implements anti-analysis, persistence via registry keys, keylogging and proxy-based C2 communications to 66.42.43.177:443, and the report includes detailed IOCs and MITRE ATT&CK mappings.