The dropped executable mpsvc.dll, although containing a large quantity of unique code, was genetically similar to exile-RAT and keyboy; both are RATs Pirate Panda deploys. It is likely that the threat actors modified and developed the code since it was last used. The dll has a compilation date of 22 April 2020, which is two days after the c2 domain was registered, and the phishing email was sent on 27 April 2020. exile-RAT has been observed using the same DLL Sideloading technique, using a legitimate security product to load a malicious dll. In this instance, Windows Defender is being used