Shadow Persistence: The UAT-5394 Infrastructure Pivot and Emerging Fileless Infection Chains

Executive Summary

The cybersecurity landscape has reached a critical inflection point in late August 2026, as evidenced by a series of sophisticated campaigns documented over the last 24-72 hours. Analysis conducted by the Encrygma Threat Intel Unit highlights a dual threat: the rapid evolution of North Korean-linked malware infrastructure and the rise of highly evasive, fileless delivery mechanisms. The primary focus of recent activity is UAT-5394, a threat cluster with tactical overlaps to Kimsuky, which has transitioned from relying on third-party cloud services to a complex, multi-layered command-and-control (C2) architecture for its MoonPeak RAT. Simultaneously, the emergence of the PeakLight downloader demonstrates the continued effectiveness of memory-resident malware in bypassing traditional endpoint protection. Additionally, the disclosure of exploitation details for critical vulnerabilities in enterprise software like Veeam Backup & Replication (CVE-2024-40711) poses an immediate risk of large-scale ransomware deployment. Organizations must adopt an aggressive defensive posture centered on memory forensics and infrastructure-based detection.

Background & Context

For the past several years, North Korean advanced persistent threat (APT) groups have refined their ability to adapt open-source tooling for espionage. The MoonPeak RAT is a direct descendant of the XenoRAT framework, a C#-based open-source tool. However, recent telemetry indicates that UAT-5394 is no longer merely using the tool but is actively forking and evolving it independently to stay ahead of static signatures.

In parallel, the broader threat landscape is seeing a resurgence of "fileless" techniques. The PeakLight malware, first detailed by Mandiant researchers in the current reporting cycle, exemplifies this trend by utilizing LNK files and PowerShell to execute entirely in RAM. This shift toward memory-only operations is likely a response to the increased efficacy of automated sandboxing and file-based scanning in modern EDR solutions. Furthermore, the exploitation of trusted enterprise backup solutions like Veeam highlights a strategic shift among ransomware affiliates (such as Fog and Akira) to target the very systems designed to facilitate recovery, thereby increasing their extortion leverage.

Analysis

MoonPeak: The XenoRAT Evolution

Technical analysis of recent MoonPeak samples reveals a deliberate effort to customize the underlying XenoRAT codebase. The most significant discovery in the last 48 hours is the modification of the client namespace. The threat actor has changed the default "xeno rat client" namespace to "cmdline," a small but effective change that breaks generic decoders and prevents rogue implants from connecting to the actor's custom C2 infrastructure.

UAT-5394 has also pivoted its infrastructure strategy. Previously, the group utilized cloud storage providers like Dropbox and Google Drive for payload staging. New intelligence shows a move toward dedicated, actor-controlled servers. These servers, including identified nodes at 95.164.86[.]148 and 167.88.173[.]173, act as intermediate 'M2' servers. These systems are used to host malicious artifacts and manage the final C2 communication. The use of multiple tiers of servers, coupled with the frequent rotation of domains such as pumaria.store and yoiroyse.store, makes infrastructure tracking significantly more difficult for defenders. The group is also using VPN nodes to access their testing virtual machines (VMs), further obscuring their origin during the malware validation phase.

PeakLight: The Stealth of Memory-Only Droppers

PeakLight represents a sophisticated evolution in the delivery of commodity malware. The infection chain begins with a weaponized ZIP file, often masquerading as pirated media. Within this ZIP is a Microsoft Shortcut (LNK) file that, when executed, triggers a multi-stage process.

Our reverse engineering identifies that the LNK file uses forfiles.exe or PowerShell wildcards (*) to search for and launch mshta.exe, a legitimate Windows binary. This is a classic living-off-the-land (LotL) technique (T1218.005) designed to bypass application control policies. Mshta then retrieves an obfuscated JavaScript dropper from a Content Delivery Network (CDN), such as Bunny CDN.

The JavaScript dropper decrypts a PowerShell-based downloader (PeakLight) that resides entirely in memory. PeakLight employs advanced obfuscation, utilizing decimal-encoded ASCII and String.fromCharCode() to hide its logic. Once active, it reaches out to C2 nodes to fetch further payloads, which have included LummaC2, ShadowLadder, and CryptBot. The use of CDNs to host these payloads provides the attackers with high availability and the ability to hide malicious traffic among legitimate web service requests.

Vulnerability Landscape: Veeam and BrazenBamboo

Beyond malware families, exploit techniques targeting critical infrastructure are surging. CVE-2024-40711, a deserialization of untrusted data vulnerability in Veeam Backup & Replication, has seen the publication of multiple proof-of-concept (PoC) exploits in the last 72 hours. With a CVSS score of 9.8, this vulnerability allows unauthenticated remote code execution. Ransomware groups are already integrating this into their playbooks to create new local administrator accounts and move laterally within networks.

Simultaneously, the actor cluster BrazenBamboo has been identified exploiting a zero-day in FortiClient for Windows to extract VPN credentials directly from process memory. This modular framework, known as DEEPDATA, uses a specialized plugin to locate and decrypt JSON objects in the memory of the FortiClient process, providing the attackers with persistent, legitimate access to corporate networks without the need for traditional brute-forcing or phishing.

Key Findings

• Customized Tooling: UAT-5394 is actively modifying open-source RAT namespaces to defeat automated analysis and ensure C2 exclusivity.
• Infrastructure Tiering: North Korean actors have transitioned from public cloud staging to a multi-tiered, dedicated server model to increase operational longevity.
• Memory-Resident Stagers: PeakLight utilizes advanced PowerShell obfuscation and CDN abuse to execute fileless payloads, effectively evading disk-based security controls.
• Backup Solutions Under Fire: The rapid weaponization of CVE-2024-40711 highlights a systemic risk to enterprise disaster recovery assets.
• Credential Harvesting via Memory: Modular frameworks like DEEPDATA are successfully targeting VPN client process memory to exfiltrate unencrypted credentials.

Attribution & Confidence

• UAT-5394: High confidence of North Korean nexus due to significant tactical overlaps with Kimsuky (APT43). The focus on nuclear research and policy targets aligns with historical DPRK intelligence requirements.
• PeakLight Operations: Moderate confidence that this represents a Malware-as-a-Service (MaaS) operation, given the delivery of diverse info-stealer families like LummaC2.
• BrazenBamboo: Moderate to High confidence of China-linked nexus (associated with APT41), based on the use of the DEEPDATA/LightSpy framework and sophisticated targeting of communication platforms.

Defensive Recommendations

1. Enhance Memory Monitoring: Deploy EDR rules to detect the anomalous execution of mshta.exe through forfiles.exe or PowerShell. Monitor for suspicious memory allocations and process hollowing techniques.
2. Infrastructure Hardening: Immediately patch Veeam Backup & Replication to the latest version to mitigate CVE-2024-40711. If patching is not possible, restrict access to the VBR server via firewall rules and isolate it from the broader production network.
3. Credential Protection: Implement Credential Guard in Windows environments to protect secrets stored in memory. Regularly audit FortiClient and other VPN clients for signs of unauthorized memory access or debugging.
4. Network-Level Detection: Block known malicious domains and IPs associated with UAT-5394, such as pumaria.store and the 103.119.112[.]0/24 range. Implement SSL/TLS inspection to identify C2 traffic hidden in CDN-bound communications.
5. Audit Living-off-the-Land: Restrict the use of administrative tools like forfiles.exe, comp.exe, and more.com to only authorized accounts and processes.

Outlook

The trajectory of recent attacks suggests that the divide between state-sponsored espionage and financial crime is narrowing, particularly in the use of sophisticated infrastructure. We expect UAT-5394 to continue evolving the MoonPeak RAT, likely adding more robust encryption to its C2 communication protocol in the coming months. The success of memory-only droppers like PeakLight will likely inspire other MaaS providers to adopt similar fileless delivery methods. In the immediate term, the exploitation of Veeam will lead to a spike in high-impact ransomware events, necessitating an urgent review of backup security and offline storage policies across all sectors.