The attackers have expanded beyond backdoors and recently started using Deed RAT to step up their attacks.