Trochilus and New Moon Wind RATs Used In Attack Against Thai Organizations
Summary: From September through late November 2016, a threat actor group used the Trochilus RAT and a newly identified RAT Unit 42 named MoonWind to target organizations in Thailand, including a utility organization, hosting both on two compromised legitimate Thai websites and using separate command and control servers for each malware family. The researchers also found Mimikatz alongside the RATs, and traced additional MoonWind samples to the same C2 (dns[.]webswindows[.]com) hosted on a compromised student portal for a Thai university in late September to early October 2016.
Bottom line: The attackers ran two RAT families from the same compromised sites against the same organization at once, with separate C2 infrastructure specifically to defeat attempts to link the attacks - and MoonWind's persistence service checks every 60 seconds and respawns the implant if it is killed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026