Dark Caracal has introduced sophisticated evasion techniques in this campaign, such as dynamic API resolution, Twofish encryption with per-build keys, and exception-handler hijacking to bypass security tools. The attack scope has expanded, with 49% of recent phishing attempts targeting technology firms, a 33% increase from 2023. Financial organizations and manufacturing enterprises remain key targets, reflecting the group's continued focus on financial espionage and intellectual property theft. This shift in targeting shows Dark Caracal’s evolving tactics beyond their earlier Bandook RAT operations.

Once Poco RAT is deployed, it performs extensive reconnaissance, including virtualization detection through registry checks and port scanning. It collects system details such as usernames, OS versions, and RAM metrics, formatting them into structured reports. The malware communicates with its command-and-control (C2) infrastructure using heartbeat messages to IPs like 193.233.203.63 while cycling through ports 6211–6543 to evade network-based defenses. Key capabilities include screen capture (T-05), fileless payload execution (T-03), and passthrough command prompt access (T-06), enabling attackers to maintain deep persistence within compromised networks.

Infrastructure analysis by the Researcher reveals strong overlaps between Poco RAT and Bandook operations, with both malware families using the same hosting providers. AS200019 (AlexHost SRL) hosts Poco RAT (185.216.68.121) alongside Bandook C2 servers (185.216.68.143), while AS44477 (Stark Industries Ltd.) has served both campaigns since 2023. With Poco RAT infections rising by 36% year-over-year, this attack highlights the growing sophistication of Dark Caracal’s methods. To counter these threats, organizations must implement defense-in-depth strategies, combining advanced technical controls with rigorous user awareness training to mitigate phishing risks and cloud abuse tactics.

Impact

• Security Bypass
• Sensitive Data Theft
• Financial Loss

Indicators of Compromise

IP

• 185.10.68.52

• 45.67.34.219

• 77.91.100.237

• 94.131.119.126

• 185.216.68.121

MD5

• a5073df86767ece0483da0316d66c15c

• 2a0f523b9e52890105ec6fbccd207dcd

• e0bf0aee954fd97457b28c9233253b0a

• bbfbd1ece4f4aa43d0c68a32d92b17e5

• a2ea38d11bde2a4483b86321960d6319

• a12d326845a96a03867b2b70ca8f12ee

SHA-256

• 05bf7db7debfeb56702ef1b421a336d8431c3f7334187d2ccd6ba34816a3fd5a

• 08552f588eafceb0fa3117c99a0059fd06882a36cc162a01575926736d4a80eb

• 0d6822c93cb78ad0d2ad34ba9057a6c9de8784f55caa6a8d8af77fed00f0da0a

• 1786f16a50a4255df8aa32f2e21f2829b4f8aaba2ced3e4a7670846205b3ac70

• 01e8536751080ea135c3ad7ae9187d06cdcccddfc89bc0d41ea4281eeb3e9fb4

• 21ff46a6fc9173fcc147d7a5c603032c662c6c1f1b05c1bb1e30e20e168bb056

SHA1

• d0661df945e8e36aa78472d4b60e181769a3f23b

• f3a495225dc34cdeba579fb0152e4ccba2e0ad42

• ce611811d9200613c1a1083e683faec5187a9280

• 2ffdf164f6b8e2e403a86bd4d0f6260bf17fb154

• 5240860d0db91bd8e13a150676a3ab1917312c59

• 3b1264d2e156a09142847b6a18f70a3267c406e2

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Train employees to recognize phishing attempts, especially financial-themed lures.
• Implement email filtering to block suspicious attachments and links.
• Use DMARC, DKIM, and SPF records to prevent email spoofing.
• Deploy endpoint detection and response (EDR) solutions to identify and block suspicious behavior.
• Use application whitelisting to prevent unauthorized execution of files like rev archives.
• Monitor process injection attempts, particularly into iexplore.exe or similar processes.
• Restrict access to cloud storage services if not required for business operations.
• Use web filtering to block access to known malicious URLs and domains.
• Monitor outbound traffic for unusual connections to C2 IPs like 193.233.203.63 and ports 6211–6543.
• Ensure regular backups of critical data and store them offline.
• Keep antivirus and anti-malware solutions updated to detect evolving threats.
• Encrypt sensitive files to limit data exposure in case of a breach.
• Patch operating systems and software regularly to close security vulnerabilities.
• Disable execution of scripts and macros from untrusted sources.
• Implement network segmentation to limit lateral movement in case of an infection.
• Set up centralized logging to detect early signs of compromise.
• Conduct regular threat-hunting exercises to identify hidden threats.
• Develop an incident response plan to contain and remediate infections quickly.