Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0428
MITRE ATT&CK Malware

PoetRAT (S0428)

ShareXLinkedInRedditHN

[PoetRAT](https://attack.mitre.org/software/S0428) is a remote access trojan (RAT) that was first identified in April 2020. [PoetRAT](https://attack.mitre.org/software/S0428) has been used in multiple campaigns against the private and public sectors in Azerbaijan, including ICS and SCADA systems in the energy sector. The STIBNITE activity group has been observed using the malware. [PoetRAT](https://attack.mitre.org/software/S0428) derived its name from references in the code to poet William Shakespeare. (Citation: Talos PoetRAT April 2020)(Citation: Talos PoetRAT October 2020)(Citation: Dragos Threat Report 2020)

Platforms: Windows

▪Techniques implemented (35)

T1033System Owner/User DiscoveryT1041Exfiltration Over C2 ChannelT1071.002File Transfer ProtocolsT1027.010Command ObfuscationT1059.003Windows Command ShellT1048Exfiltration Over Alternative ProtocolT1204.002Malicious FileT1571Non-Standard PortT1112Modify RegistryT1566.001Spearphishing AttachmentT1083File and Directory DiscoveryT1105Ingress Tool TransferT1564.001Hidden Files and DirectoriesT1119Automated CollectionT1125Video CaptureT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolT1497.001System ChecksT1018Remote System DiscoveryT1071.001Web ProtocolsT1082System Information DiscoveryT1559.002Dynamic Data ExchangeT1003.001LSASS MemoryT1057Process DiscoveryT1059.005Visual BasicT1573.002Asymmetric CryptographyT1059.006PythonT1113Screen CaptureT1140Deobfuscate/Decode Files or InformationT1027Obfuscated Files or InformationT1059.011LuaT1547.001Registry Run Keys / Startup FolderT1070.004File DeletionT1555.003Credentials from Web BrowsersT1560.001Archive via UtilityT1056.001Keylogging
S0428on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.