A North Korea-linked threat actor has deployed a new malware family and shifted from using legitimate cloud-based servers to operating its own infrastructure, according to a U.S. cybersecurity firm.

The new remote access trojan (RAT) appears to be a modified version of the open-source XenoRAT malware previously linked to North Korean phishing operations, Cisco Talos said in a report published on Wednesday, dubbing the new malware family “MoonPeak.”

XenoRAT has multiple functions, including allowing attackers to remotely load additional malicious payloads, launch and terminate processes and access the victim’s microphone. 

Talos