Last seven days
- First activity
- Jul 19, 2026
- Last activity
- Jul 22, 2026
- Feed role
- C2
- Host form
- 1 IP / 2 hostnames
Malware family
XenoRAT
XenoRAT is an open-source .NET remote access trojan publicly available on GitHub and used by multiple threat actors for persistent remote access, surveillance, and post-exploitation.
Profile source: Mallory opens in a new tabXenoRAT
Family profile
XenoRAT is an open-source .NET remote access trojan publicly available on GitHub and used by multiple threat actors for persistent remote access, surveillance, and post-exploitation. Reported capabilities in the provided content include encrypted TCP command-and-control, dynamic assembly loading, remote command execution, file operations, keylogging, screen capture, clipboard monitoring, webcam and microphone surveillance, SOCKS5 tunneling, self-uninstall, and collection or exfiltration of system information. The malware has been observed delivered through spear-phishing and multi-stage loader chains using malicious LNK files, ZIP archives, PowerShell, HTA, JavaScript, Python loaders, and GitHub- or web-hosted staging infrastructure. Persistence mechanisms directly mentioned include Windows scheduled tasks such as XenoUpdateManager and registry Run key entries including a value named Edgre; one report also noted the mutex clouda, while another observed Xeno_rat_nd8912d and install path %LOCALAPPDATA%\XenoManager\. Version 1.8.7 is specifically referenced multiple times as a final payload. In the supplied reporting, XenoRAT was associated with SideCopy/Transparent Tribe/APT36 in Operation XENOFISCAL targeting Afghanistan’s Ministry of Finance and provincial finance officials, with command-and-control at 185.235.137.106 and delivery via compromised Afghan infrastructure including abimj.edu.af. It was also referenced in DPRK-linked activity, including MoonPeak as a customized variant of the XenoRAT codebase, campaigns targeting South Korean users and organizations, and German-language SERPENTINE#CLOUD activity that deployed XenoRAT v1.8.7 with C2 at 176.96.136.182. Additional content ties XenoRAT-type payload delivery to spear-phishing campaigns observed by AhnLab in South Korea and to multi-payload shellcode loaders alongside XWorm and AsyncRAT.
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Jul 19
1 Jul 20
1 Jul 22
Observed infrastructure
Leading locations
- US2
- RU1
Leading providers
- United Cooperative Services1
- Wowrack.com1
- Yandex.Cloud LLC1
Infrastructure traits
- Hosting 2
Samples
Recent associated samples
23ac180f55e1317de214e450fcb399aa687ca1bd3252a5b7e112bbaf49d0bf42 Observed Jul 22, 2026Triage
29344500383487701f9a61e7bb136c01eff46954993c39071bf04d4df3d207e5 Observed Jul 22, 2026Triage
36ae1fafc5722b0e3ea0b92ed37d3debf04983da0569e9bc8cfd5488e49a279d Observed Jul 22, 2026Triage
3892c0d5b4d02641c6381904b38950246dd66c58738be1411d46d671e7b7cab1 Observed Jul 22, 2026Triage
bc69d5f3877ffb4bc65b9d314d04817c84ee86fc159923337853968000270d5b Observed Jul 22, 2026Triage
0b48a2e61fc087a902087e458945d8f4e095c23e59d170cdfddf5170670e4f62 Observed Jul 20, 2026Triage
80246e45911dacf16bd729037fb08d25e2aa38b786a10c7c7bdc7777cf2a1518 Observed Jul 20, 2026Triage
622ce6b9c88da24478fdce6e6c09bd3a063164af06dfe0c96b18e795ff76746e Observed Jul 19, 2026Triage
Reported operators
Threat actors
7 named in public reportingSeqrite Labs identified a sophisticated SideCopy XenoRAT malware attack focused directly on government networks.
Seqrite Labs identified a sophisticated SideCopy XenoRAT malware attack focused directly on government networks.
The group’s arsenal includes proprietary malware such as PebbleDash, BabyShark, AppleSeed, and RandomQuery, as well as open-source RATs like xRAT, XenoRAT, and TutRAT.
While earlier versions spread the XenoRAT malware, the current version focuses on deep surveillance.
While earlier versions spread the XenoRAT malware, the current version focuses on deep surveillance.
…LUMMASTEALER, XENORAT, SECTOPRAT…
“Although XMRig CoinMiner is installed in the end, XenoRAT and a vulnerability scanner script are also installed.”
Exploited software
Vulnerabilities linked to XenoRAT
1 CVEsMITRE ATT&CK
XenoRAT in ATT&CK
53 distinct techniquesTechniques
53 techniques T1219 Remote Access Tools T1105 Ingress Tool Transfer T1059.001 PowerShell T1204.002 Malicious File T1620 Reflective Code Loading T1027 Obfuscated Files or Information T1566.001 Spearphishing Attachment T1071 Application Layer Protocol T1059.007 JavaScript T1598 Phishing for Information T1547.001 Registry Run Keys / Startup Folder T1036 Masquerading T1218.005 Mshta T1584 Compromise Infrastructure T1566 Phishing T1071.001 Web Protocols T1053.005 Scheduled Task T1059.005 Visual Basic T1497.001 System Checks T1480.002 Mutual Exclusion T1573 Encrypted Channel T1012 Query Registry T1562.001 Disable or Modify Tools T1123 Audio Capture T1082 System Information Discovery T1095 Non-Application Layer Protocol T1129 Shared Modules T1090.002 External Proxy T1027.011 Fileless Storage T1113 Screen Capture T1140 Deobfuscate/Decode Files or Information T1564.001 Hidden Files and Directories T1070.004 File Deletion T1056.001 Keylogging T1055 Process Injection T1115 Clipboard Data T1518 Software Discovery T1106 Native API T1125 Video Capture T1059.003 Windows Command Shell T1102.003 One-Way Communication T1059.006 Python T1055.004 Asynchronous Procedure Call T1005 Data from Local System T1112 Modify Registry T1041 Exfiltration Over C2 Channel T1083 File and Directory Discovery T1203 Exploitation for Client Execution T1059 Command and Scripting Interpreter T1567 Exfiltration Over Web Service T1057 Process Discovery T1497 Virtualization/Sandbox Evasion T1204 User Execution
Reporting
Research mentioning XenoRAT
Jul 21
Lazarusholic Bluesky
Post by @lazarusholic.bsky.social - Bluesky
"게임 업계 대상 MoonPeak 감염 사례 분석" published by Hauri. #LNK, #XenoRAT, #MoonPeak
Jul 21
Hauri Co Kr
(주)하우리
최종적으로 XenoRAT 기반 변종으로 알려진 MoonPeak을 로드하는 것을 확인하였다.
Jul 7
Gurucul Threat Research
Millenium: A RAT Rewritten, a Threat Multiplied | Community Portal | Gurucul
XenoRAT2
Jul 6
Levelblue Spiderlabs
From Phishing to Persistence: A CrySome RAT Infection Chain Analysis
While the script references “Xeno”, likely tied to XenoRAT, we believe this script is likely reused with a newer CrySome RAT payload.
Jun 24
Ahnlab Asec
May 2026 Threat Trend Report on APT Attacks (South Korea) - ASEC
Type C uses PowerShell code embedded within the LNK file to create and execute Base64-encoded data in %TEMP%, then downloads decoy files and malicious scripts from a GitHub repository. It creates a Task Scheduler entry to ensure persistence, deploys XenoRAT-type malware, and exfiltrates system information.
Jun 3
Security Online Info
SideCopy XenoRAT Malware Attack Targets Afghanistan
Seqrite Labs identified a sophisticated SideCopy XenoRAT malware attack focused directly on government networks.
Jun 1
Cyber Security News
SideCopy Hackers Deploy Persistent XenoRAT Malware to Target Afghanistan Finance Ministry
The final stage deployed XenoRAT 1.8.7, an open-source Remote Access Trojan available on GitHub, which established an encrypted connection to a bulletproof server in Frankfurt, Germany.
May 31
The Record Media
Afghan finance officials targeted by suspected Pakistani cyberespionage campaign | The Record from Recorded Future News
Once opened, the file silently installed XenoRAT, an open-source remote access trojan that allows attackers to maintain long-term access to infected systems.
