Microcin

Microcin is a Trojan malware family associated in the provided content with the Chinese-speaking threat actor SixLittleMonkeys. Kaspersky described it as a Trojan used exclusively by SixLittleMonkeys, and reported an active campaign in which the group used a new version of Microcin together with a RAT named HawkEye as a last stager. The content also links Microcin to activity related to the ExCone/DexCone cluster and notes that the same broader actor targeted Russian government institutions and later Russian educational institutions via spear-phishing campaigns. Microcin is specifically cited by Securelist as one of multiple malware families that use steganography. In the MoonBounce investigation, Kaspersky found Microcin in the same victim environment as the MoonBounce UEFI implant and other malware, but stated that the connection between Microcin and MoonBounce was only low confidence. High-confidence behavioral details beyond its classification as a Trojan and its use of steganography are not provided in the content.