{
  "name": "MoonPeak malware unveils new details on attacker infrastructure",
  "slug": "moonpeak-malware-unveils-new-details-on-attacker-infrastructure",
  "description": "Cisco Talos has uncovered a campaign employing a new malware family called 'MoonPeak,' a remote access trojan actively developed by a North Korean advanced persistent threat group tracked as 'UAT-5394.' The analysis reveals the evolution of MoonPeak from an open-source malware called XenoRAT, with the threat actors introducing modifications to evade detection and analysis. Talos mapped the infrastructure used in this campaign, including command and control servers, payload hosting sites, and virtual machines for testing implants, unveiling the tactics, techniques, and procedures employed by UAT-5394.",
  "published": "2024-08-21T11:02:51+00:00",
  "created_at": "2024-08-21T11:02:51+00:00",
  "modified_at": "2024-08-21T11:29:22+00:00",
  "created_at_opencti": "2024-08-21T11:02:51+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-08-21",
    "moonpeak",
    "north korea",
    "quasarrat",
    "xenorat"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "95.164.86.148"
      },
      {
        "id": "",
        "name": "91.194.161.109"
      },
      {
        "id": "",
        "name": "84.247.179.77"
      },
      {
        "id": "",
        "name": "80.71.157.55"
      },
      {
        "id": "",
        "name": "45.95.11.52"
      },
      {
        "id": "",
        "name": "45.87.153.79"
      },
      {
        "id": "",
        "name": "27.255.81.118"
      },
      {
        "id": "",
        "name": "27.255.80.162"
      },
      {
        "id": "",
        "name": "212.224.107.244"
      },
      {
        "id": "",
        "name": "167.88.173.173"
      },
      {
        "id": "",
        "name": "210.92.18.169"
      },
      {
        "id": "",
        "name": "104.194.152.251"
      },
      {
        "id": "",
        "name": "159.100.29.122"
      },
      {
        "id": "",
        "name": "yoiroyse.store"
      },
      {
        "id": "",
        "name": "pumaria.store"
      },
      {
        "id": "",
        "name": "nsonlines.store"
      },
      {
        "id": "",
        "name": "nmailhostserver.store"
      },
      {
        "id": "",
        "name": "f928a0887cf3319a74c90c0bdf63b5f79710e9f9e2f769038ec9969fcc8ee329"
      },
      {
        "id": "",
        "name": "facf3b40a2b99cc15eee7b7aee3b36a57f0951cda45931fcde311c0cc21cdc71"
      },
      {
        "id": "",
        "name": "f4aa4c6942a87087530494cba770a1dcbc263514d874f12ba93a64b1edbae21c"
      },
      {
        "id": "",
        "name": "a80a35649f638049244a06dd4fb6eca4de0757ef566bfbe1affe1c8bf1d96b04"
      },
      {
        "id": "",
        "name": "b8233fe9e903ca08b9b1836fe6197e7d3e98e36b13815d8662de09832367a98a"
      },
      {
        "id": "",
        "name": "97ba8d30cf8393c39f61f7e63266914ecafd07bd49911370afb866399446f37d"
      },
      {
        "id": "",
        "name": "72a25d959d12e3efe9604aee4b1e7e4db1ef590848d207007419838ddbad5e3f"
      },
      {
        "id": "",
        "name": "8a4fbcdec5c08e6324e3142f8b8c41da5b8e714b9398c425c47189f17a51d07b"
      },
      {
        "id": "",
        "name": "6bf8a19deb443bde013678f3ff83ab9db4ddc47838cd9d00935888e00b30cee6"
      },
      {
        "id": "",
        "name": "58fdc1b6ce4744d6331f8e2efc4652d754e803cae4cc16101fc78438184995e6"
      },
      {
        "id": "",
        "name": "6a3839788c0dafe591718a3fb6316d12ccd8e82dbcb41ce40e66b743f2dd344d"
      },
      {
        "id": "",
        "name": "4599a9421e83fb0e2c005e5d9ac171305192beabe965f3385accaf2647be3e8e"
      },
      {
        "id": "",
        "name": "44e492d5b9c48c1df7ef5e0fe9a732f271234219d8377cf909a431a386759555"
      },
      {
        "id": "",
        "name": "41d4f7734fbf14ebcdf63f51093718fd5a22ec38a297c0dc3d7704a3fb48b3f9"
      },
      {
        "id": "",
        "name": "458641936e2b41c425161a9b892d2aa08d1de2bc0db446f214b5f87a6a506432"
      },
      {
        "id": "",
        "name": "3e39fc595db9db1706828b0791161440dc1571eaa07b523df9b721ad65e2369b"
      },
      {
        "id": "",
        "name": "4108c5096a62c0a6664eed781c39bb042eb0adf166fcc5d64d7c89139d525d4f"
      },
      {
        "id": "",
        "name": "2b35ef3080dcc13e2d907f681443f3fc3eda832ae66b0458ca5c97050f849306"
      },
      {
        "id": "",
        "name": "293b1a7e923be0f554ec44c87c0981c9b5cf0f20c3ad89d767f366afb0c1f24a"
      },
      {
        "id": "",
        "name": "27202534cc03a398308475146f6710b790aa31361931d4fe1b495c31c3ed54f7"
      },
      {
        "id": "",
        "name": "1ad43ddfce147c1ec71b37011d522c11999a974811fead11fee6761ceb920b10"
      },
      {
        "id": "",
        "name": "15eee641978ac318dabc397d9c39fb4cb8e1a854883d8c2401f6f04845a79b4b"
      },
      {
        "id": "",
        "name": "0ed643a30a82daacecfec946031143b962f693104bcb7087ec6bda09ade0f3cb"
      },
      {
        "id": "",
        "name": "148c69a7a1e06dc06e52db5c3f5895de6adc3d79498bc3ccc2cbd8fdf28b2070"
      },
      {
        "id": "",
        "name": "0b8897103135d92b89a83093f00d1da845a1eae63da7b57f638bab48a779808e"
      }
    ],
    "malware": [
      {
        "id": "b7635e08-7c76-43cd-8340-8d83e9feaec2",
        "name": "MoonPeak",
        "slug": "moonpeak"
      },
      {
        "id": "9c08757d-bd59-45d1-8174-ac5b1ab454f2",
        "name": "XenoRAT",
        "slug": "xenorat"
      },
      {
        "id": "7c540925-36a7-4fc2-aaf2-5f18e92870af",
        "name": "QuasarRAT",
        "slug": "quasarrat"
      }
    ],
    "intrusion_sets": [
      {
        "id": "1f70790c-8a82-41ba-82bc-2aa21ae6435b",
        "name": "UAT-5394",
        "slug": "uat-5394"
      }
    ],
    "attack_patterns": [
      {
        "id": "30fcebc4-6a32-43bc-b86f-09ec8d055dbc",
        "name": "T1609"
      },
      {
        "id": "4d36ebe8-4925-419a-bdd5-73f6427a975d",
        "name": "T1064"
      },
      {
        "id": "99a1fb98-1a01-485b-b90a-a9f362f41a84",
        "name": "T1091"
      },
      {
        "id": "00430919-9257-403b-8a1b-958d4c3613aa",
        "name": "T1557"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "d9f271ed-7685-4362-b90d-f16a14102f39",
        "name": "T1489"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "6e4e21cc-92cf-4564-920e-d509bd22fd40",
        "name": "T1574"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "14da8ebf-e0b0-4d4e-9c83-56277980f266",
        "name": "T1134"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "c1e3fabe-9e8b-4e8f-a1f8-bf23e234e770",
        "name": "T1485"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "358e04b8-6f65-48b2-a24b-f101bfc6671a",
        "name": "T1195"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://blog.talosintelligence.com/moonpeak-malware-infrastructure-north-korea/",
    "https://otx.alienvault.com/pulse/66c5e57b2b143c88a3b9e9ae"
  ]
}