Hidden in Plain Sight: TA397’s New Attack Chain Delivers Espionage RATs

Author(s): David Galazin, Konstantin Klinger, Nick Attfield, Pim Trouerbach
Organization: Proofpoint

Open article directly

2026-02-19 ⋅ Proofpoint ⋅ Proofpoint
(Don't) TrustConnect: It's a RAT in an RMM hat
TrustConnect RAT

2026-01-28 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team
Can’t stop, won’t stop: TA584 innovates initial access
XWorm TA584

2025-12-18 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team
Access granted: phishing with device code authorization for account takeover
TA2723 UNK_AcademicFlare

Propose Change Hidden in Plain Sight: TA397’s New Attack Chain Delivers Espionage RATs