UAT-5394 — which has been suspected to be Kimsuky, its subgroup, or a separate operation leveraging Kimsuky’s toolkit — established updated test virtual machines, payload-hosting sites, and command-and-control servers to support the creation of new MoonPeak RAT variants as part of the attack campaign, according to a Cisco Talos analysis. Researchers also discovered the introduction of more advanced anti-analysis techniques and overall communication mechanism alterations with every succeeding MoonPeak iteration.

Source: SC Magazine