Moon Peak malware from North Korean actors unveils new details on attacker infrastructure
Summary: Cisco Talos detailed a new XenoRAT-based remote access trojan it calls MoonPeak, developed by a North Korean nexus cluster tracked as UAT-5394, which moved from hosting payloads on legitimate cloud storage to servers it owned and controlled after AhnLab's disclosure. Talos mapped the campaign's infrastructure, including C2 servers on ports 9999, 9966, 9936 and 8936, test virtual machines at 45[.]87[.]153[.]79 and 45[.]95[.]11[.]52, and a MoonPeak sample compiled as recently as July 16, 2024.
What you should know: The operators built and tested each MoonPeak variant on their own VMs before distribution, and one C2 server changed operating systems and web servers four times in under two months - infrastructure that rotates this fast will outrun blocklists built on static indicators.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026