Microcin

Microcin is a Trojan associated with the Chinese-speaking threat cluster SixLittleMonkeys and has been observed in espionage-oriented intrusion activity. Reporting links a newer version of Microcin to active campaigns in which it was used alongside the HawkEye RAT as a later-stage implant. Microcin has also been noted in environments compromised by actors associated with APT41, although at least some of that linkage is assessed only with low confidence.

A notable characteristic associated with Microcin is the use of steganography. It has been cited among malware families that conceal payloads or configuration data inside image files, including BMP containers, to obscure malicious content and blend delivery or staging traffic with benign-looking media. Public tooling references indicate analysts have parsed both Microcin configuration data and steganographic BMP content, supporting the assessment that image-based hidden data is part of its tradecraft.

Available information supports classifying Microcin as a Trojan used in multi-stage intrusion chains rather than as a commodity malware family. It appears in post-compromise contexts and is associated with covert payload staging and defense-evasion techniques intended to reduce visibility of malicious artifacts and communications. Public reporting in the supplied material does not establish a definitive initial infection vector, victimology profile, or full capability set beyond its role as a staged implant using steganographic concealment.