Packrat — APT Profile

Packrat is Citizen Lab's designation for an espionage and influence operation that ran against targets in Latin America from roughly 2008 until its exposure in December 2015, the name chosen for its taste for packed commodity remote-access trojans and its habit of hoarding infrastructure for years at a time. The December 2015 report, authored by John Scott-Railton with Morgan Marquis-Boire, Claudio Guarnieri and Marion Marschalek, traced operations against opposition politicians, parliamentarians, independent journalists and civil-society figures, concentrated on Ecuador, Argentina, Venezuela and Brazil. The operators built almost nothing themselves, leaning on off-the-shelf RATs including CyberGate, XtremeRAT, AlienSpy/Adwind and Adzok, obscured with crypters and packers such as UPX, PECompact and Allatori and delivered by phishing over email, social platforms and SMS alongside credential-harvesting pages imitating webmail and government logins. Its more distinctive signature was fabricated cover: invented political movements and bogus news outlets, including a Venezuela-focused site and a spoofed Ecuadorian police identity, used to bait and discredit those it pursued. Citizen Lab stopped short of naming a sponsor, judging only that the collected intelligence most plausibly reached one or more governments in the region. Attempts documented in the report include activity connected to Argentine prosecutor Alberto Nisman in 2014 and to the journalist Jorge Lanata.

Tools & malware

jar.adzok Backdoor

Vendor research

Packrat: Seven Years of a South American Threat Actor The Citizen Lab (Munk School, University of Toronto)

Countries linked to this actor

Argentina targets
Venezuela targets

Read the full analysis on IntelFusions