MoonPeak malware from North Korean actors unveils new details on attacker infrastructure · 2024-08-21T10:00:14.000Z
Cisco Talos has uncovered a new remote access trojan (RAT) family we are calling “MoonPeak.” This a XenoRAT-based malware, which is under active development by a North Korean nexus cluster we are calling “UAT-5394.”
26th August – Threat Intelligence Report · 2024-08-26
Researchers have identified a state-sponsored North Korean threat actor, known as UAT-5394, using a newly developed remote access trojan called MoonPeak. This malware, evolving from the open-source XenoRAT, forms part of a broader infrastructure shift from cloud services to attacker-owned systems.
Undisclosed organization(s) · 21/08/2024
Researchers at Cisco Talos discover a new remote access trojan called MoonPeak, variant of XenoRAT, used in a new campaign by UAT-5394,a state-sponsored North Korean threat actor. [Date Occurred: Since at least 11/06/2024; Date Discovered: 11/06/2024]
"김수키와 수법 비슷"...시스코, 북한 해커그룹 추가 정황 포착 · 2024-08-22
attribution sentence(s): 북한 해커그룹이 새로운 해킹 프로그램으로 사이버 공격을 진행한 정황이 포착됐다. | 해당 수법은 코드네임 '김수키'라는 기존 북한 해커그룹과 비슷한 것으로 전해졌다. | 22일 미국 시스코 탈로스는 북한 해커그룹 'UAT-5394'가 '문피크(MoonPeak)'라는 새 해킹 프로그램 사용한 것을 포착했다고 밝혔다.