An investigation showed a custom backdoor RAT and the Emotet trojan in the networks of municipal victims of the attacks.
Source: Threadpost