XenoRAT is an open-source .NET remote-access Trojan adapted in North Korean-linked campaigns, including the custom MoonPeak variant. Operators delivered it through deceptive LNK files and hidden PowerShell chains, used GitHub or cloud storage for payload hosting and command infrastructure, and established persistence with scheduled tasks. Reported variants communicate through asynchronous sockets and provide broad remote control for intelligence collection. MoonPeak reused distinctive mutex values while campaigns targeted Korean organizations with business- and design-themed decoys.