This build belongs to the MoonPeak/Xeno RAT toolset, the same family tied to UAT-5394 / Kimsuky.
MoonPeak
MoonPeak is a Windows remote access trojan in the XenoRAT family, generally described as a customized or variant build of the open-source .NET XenoRAT codebase.
Profile source: Mallory opens in a new tabMoonPeak
Family profile
MoonPeak is a Windows remote access trojan in the XenoRAT family, generally described as a customized or variant build of the open-source .NET XenoRAT codebase. It has been linked at high confidence to DPRK-aligned activity, particularly Kimsuky and related tracking clusters such as UAT-5394, and has been used in campaigns targeting South Korean users as well as cryptocurrency-focused victims. Reported targeting has included South Korean organizations and users, the gaming sector, and financially themed operations aimed at cryptocurrency traders.
Observed MoonPeak intrusion chains commonly rely on social engineering and script-based staging. Document-themed or finance-themed lures have been delivered through malicious Windows shortcut files that display decoy content while covertly launching obfuscated PowerShell. In other campaigns, a trojanized cryptocurrency trading application was used to stage the malware. Delivery infrastructure has included trusted developer or content platforms such as GitHub and GitLab, which were used to host or retrieve later-stage payloads.
The malware’s staging logic has shown strong emphasis on defense evasion. Reported chains perform anti-analysis checks for virtualization and security tooling, use randomized temporary artifacts, and in some cases restore payloads from manipulated GZIP data or load .NET assemblies reflectively in memory. MoonPeak samples have also been described as heavily obfuscated and capable of dynamic code decryption during execution.
Persistence has repeatedly been established through Windows scheduled tasks. Associated infection chains also perform host profiling and reconnaissance before deploying the final RAT. In some observed cases, intermediate scripts collected system information and used browser-derived data such as cookies during command-and-control communications.
As a XenoRAT-derived implant, MoonPeak is assessed to provide remote access and post-compromise control over infected Windows systems. Reporting directly associates MoonPeak campaigns with asynchronous socket-based command-and-control and with broader Kimsuky tradecraft involving staged payload retrieval, host reconnaissance, and follow-on malicious activity including credential and wallet theft in cryptocurrency-focused operations. The malware is best understood as a DPRK-linked RAT used in multi-stage intrusions that blend espionage-oriented access with financially motivated targeting.
Capabilities
- Credential Theft
- Defense Evasion
- Persistence
- Post Exploitation
- Reconnaissance
Reported operators
Threat actors
3 named in public reportingMITRE ATT&CK
MoonPeak in ATT&CK
33 distinct techniquesTechniques
33 techniques T1543 Create or Modify System Process T1140 Deobfuscate/Decode Files or Information T1053 Scheduled Task/Job T1105 Ingress Tool Transfer T1059.001 PowerShell T1036 Masquerading T1539 Steal Web Session Cookie T1497 Virtualization/Sandbox Evasion T1095 Non-Application Layer Protocol T1082 System Information Discovery T1480.002 Mutual Exclusion T1059 Command and Scripting Interpreter T1497.001 System Checks T1622 Debugger Evasion T1204.002 Malicious File T1036.005 Match Legitimate Resource Name or Location T1057 Process Discovery T1059.005 Visual Basic T1071.001 Web Protocols T1027 Obfuscated Files or Information T1053.005 Scheduled Task T1608.001 Upload Malware T1657 Financial Theft T1567.002 Exfiltration to Cloud Storage T1056.001 Keylogging T1102.002 Bidirectional Communication T1583.003 Virtual Private Server T1555.003 Credentials from Web Browsers T1102 Web Service T1566 Phishing T1567 Exfiltration Over Web Service T1592 Gather Victim Host Information T1548 Abuse Elevation Control Mechanism
Reporting
Research mentioning MoonPeak
Jul 21
Lazarusholic Bluesky
Post by @lazarusholic.bsky.social - Bluesky
Hauri reported a multi-stage MoonPeak intrusion targeting the gaming industry that began with a malicious Windows shortcut (.LNK) file disguised as a game character design document. When opened, the file launched a PowerShell-based infection chain that checked for analysis environments, gathered host information, and created aes.js at runtime to steal browser cookies, which were then used in command-and-control communications. The campaign used social engineering tailored to game-development workflows, indicating deliberate targeting of gaming-sector personnel. The malware established persistence through Windows Task Scheduler, downloaded additional payloads, and restored a later-stage component from GZIP data masquerading as an RTF file. Hauri identified the final payload as MoonPeak, a variant based on XenoRAT, citing its asynchronous socket communications with its C2 server and reuse of a mutex string previously observed in MoonPeak cases. A related social media post amplified the report and highlighted the same core elements: MoonPeak, XenoRAT, and malicious LNK delivery.
Jul 21
Hauri Co Kr
