flexhere687-art

flexhere687-art is a Turkish-origin cyber threat actor associated with an active XWorm V6.0 remote-access-trojan campaign observed since at least March 2026. The actor has used GitHub-hosted infrastructure and other cloud services to stage and deliver malware through a multi-layered infection chain aimed at English-speaking victims. Lures have included tax documents, invoices, shipping notices, banking-transfer themes, and CV-related content. The actor’s delivery methods have included obfuscated JavaScript downloaders, batch-script droppers that attempt privilege elevation, and a trojanized Python 3.12 package used as a loader. The Python component employed layered obfuscation and in-memory decryption to recover and execute shellcode, while the batch-based infection path used UAC-bypass logic, weakened Microsoft Defender through broad exclusions, and installed malware for persistence. Persistence mechanisms attributed to this activity include Run-key modification, Startup-folder placement, scheduled tasks, and abuse of legitimate Windows scripting components for execution. The payloads associated with this activity include XWorm V6.0, a commodity RAT with capabilities such as remote command execution, file management, keylogging, credential theft, process injection, and DDoS functionality. The malware set also incorporated defense-evasion features including sandbox and virtual-machine checks. Operationally, the actor relied on public platforms including GitHub, Blogger, and file-sharing services for staging and delivery. Attribution to Turkey is supported by exposed operator artifacts and Turkish-language traces in the tooling and workflow. No additional aliases or sub-groups are established at high confidence beyond the GitHub handle flexhere687-art.