The malware used in this attack is XtremeRat (ExtRat) which is a commercially available remote access trojan (RAT). Here's what we know so far.