APT / THREAT GROUP

XenoRAT

aliases

Last seen:Mar 17, 2026

Intelligence Profile

XenoRAT is an open source remote access trojan written in C#. It can monitor user activity including keystrokes, and provide remote control over the compromised system.

Threat Analysis

XenoRAT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://axmahr.github.io/posts/xenorat-detection/

→https://blog.talosintelligence.com/moonpeak-malware-infrastructure-north-korea/

→https://github.com/moom825/xeno-rat

→https://hunt.io/blog/good-game-gone-bad-xeno-rat-spread-via-gg-domains-and-github

→https://hunt.io/blog/xenorat-excel-xll-confuserex-as-access-method

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.xenoratXenoRAT

External Intelligence

Malpedia: win.xenorat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search XenoRAT