Kremlin RATs from Nigeria

Group-IB analysed three phishing campaigns active between 2019 and 2020 that targeted users across Europe and CIS countries by distributing malicious Office documents (malicious macros and exploit-based RTF/XLS) to deliver remote-access Trojans and infostealers (NetWire, AsyncRAT, WSHRAT, NanoCore, AgentTesla). The report maps adversary infrastructure (many DDNS domains, hosting IPs, C2 servers), provides multiple IOCs (SHA1s, domains, email registrants), attributes the activity to a previously unknown Nigerian threat actor, and offers MITRE-mapped defensive recommendations.