Cisco Talos says different groups around the world are abusing the MacroPack framework do deploy malware.
https://www.techradar.com/pro/attackers-abuse-red-teaming-tool-to-deploy-brute-ratel
https://www.techradar.com/pro/attackers-abuse-red-teaming-tool-to-deploy-brute-ratel