Packrat__2015__Packrat_Seven_Years_of_a_South_American_Threat_Actor.pdf

This Citizen Lab report documents a seven-year regional campaign by the threat actor "Packrat" that used commodity RATs (AlienSpy/Adwind, CyberGate, XtremeRAT, Adzok), social-engineered phishing (malicious DOCX/JAR/links), and fake political/media sites to target journalists, opposition figures and government officials across Ecuador, Venezuela, Argentina and Brazil; it details C2 infrastructure, sample configurations, phishing domains and other IOCs, and assesses likely state sponsorship while not conclusively attributing responsibility.