Poco RAT

Poco RAT is a remote access trojan used in campaigns against Spanish-speaking organizations in Latin America, including the mining sector. Activity distributing the malware has been attributed to Dark Caracal, also known as Darkling APT, an espionage-focused threat actor. Documented campaigns use phishing emails with malicious PDF attachments that direct recipients to download intermediate files from file-sharing services; those files execute droppers that install Poco RAT. The malware provides remote control of compromised endpoints, supports command execution, and collects system information. Dark Caracal has also distributed Poco RAT through financial-themed phishing as part of cyber-espionage operations.