Hunt.io blog
XenoRAT linked to North Korean group (in "Good Game, Gone Bad: Xeno RAT Spread Via .gg Domains and GitHub") · 2024-06-25T00:00:00.000Z
Most recently, AhnLab’s ASEC reported on a likely North Korea-linked group using Dropbox to deliver Xeno RAT to victim networks. In late April, a third-party researcher on X posted on an open directory likely administered by the Kimsuky threat group, hosting a copy of the tool in a folder titled “/rat.”