Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Good Game, Gone Bad: Xeno RAT Spread Via .gg Domains and GitHub

hunt.io | blog | #github | #c2 | #rat | #north-korea | #gaming | #xeno-rat | #gg-domains

Summary

Hunt found Xeno RAT C2 servers on .gg domains and a GitHub repo posing as Roblox tooling, tracing the open-source RAT's spread through gaming communities, with links to a North Korean group.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Spotting SparkRAT: Detection Tactics & Sandbox Findings
Hunt profiles SparkRAT, the Go-based RAT behind attacks tracked by Microsoft and AhnLab, with detection tips for its default port 8000 and login-page fingerprints.
blog · hunt.io
Open Directory Exposes Phishing Campaign Targeting Google & Naver Credentials
Hunt tracked a likely North Korean campaign stealing Google and Naver credentials via iframes after its Binance spoof was flagged; an open directory also held Xeno-RAT and KakaoTalk logs.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Malicious VSCode Extension Launches Multi-Stage Attack Chain with Anivia Loader and OctoRAT
A fake 'prettier-vscode-plus' extension on the official VSCode Marketplace delivered the Anivia loader and OctoRAT—a RAT with 70+ commands—in a supply-chain attack that rotated payloads.
blog · hunt.io
Exposing the Deception: Russian EFF Impersonators Behind Stealc & Pyramid C2
An open directory tied to EFF-impersonating actors targeting Albion Online players exposed decoy documents and Stealc/Pyramid C2 malware; shared SSH keys linked 11 more servers.
blog · hunt.io
Unmasking SparkRAT: Detection & macOS Campaign Insights
Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.
back