Packrat: Seven Years of a South American Threat Actor

This Citizen Lab report documents "Packrat," a persistent South American threat actor active from at least 2008–2015 that combined commodity RATs (AlienSpy/Adwind, CyberGate, XtremeRAT, Adzok), extensive phishing, lookalike domains and fabricated political/media personas to surveil and manipulate political opponents, journalists and government figures across Ecuador, Venezuela, Argentina and Brazil; the report includes detailed malware configuration analysis, mapped C2 infrastructure, representative attack case studies, numerous IOCs and discussion of possible state sponsorship.