The attackers have spruced up the ‘vncDll’ module used for spying on targets and stealing data.
Source: Threadpost