Loading story…
Researchers reported renewed activity and fresh analysis of Hworm—also tracked as Houdini and njRAT—showing the long-running remote access trojan continuing to evolve from earlier Delphi-based campaigns into newer fileless delivery chains. Earlier campaigns used self-extracting archives with Middle East and Mediterranean political lures and decoy content while the malware ran in the background, and researchers tied some development to semi-public builder tooling and a Delphi rewrite discussed in underground forums. The malware family supports broad remote administration functions including keylogging, screenshot capture, file management, browser password theft, persistence, and process injection.
Recent analysis described a VBScript-based injector that uses DynamicWrapperX, base64-encoded components such as DCOM_DATA, LOADER_DATA, and FILE_DATA, and forced execution through 32-bit wscript.exe on 64-bit Windows systems before injecting the final payload into msbuild.exe. Across samples, Hworm/njRAT established persistence through the Windows Run registry key and copied itself into user-accessible paths, while command-and-control shifted from older HTTP-style traffic to mixed binary-and-ASCII TCP communications. Analysts also identified embedded configuration data including mutex values, installation paths, ports, and C2 infrastructure such as chroms.linkpc.net and 85.26.235.163:7777, alongside anti-analysis checks for tools including Wireshark, Process Hacker, dnSpy, Sandboxie, and VMware or VirtualBox services.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
On June 21, 2020, an analyst published analysis of an njRAT .NET sample that copied itself to multiple locations, created a Run key for persistence, and was configured to contact 85.26.235.163 on port 7777.
On September 13, 2019, jeFF0Falltrades published YARA rules and hashes for WSH RAT, described as a variant of H-Worm/Houdini. The rules covered the decoded VBScript component and .NET modules for keylogging, RDP, and reverse proxy functionality.
On October 25, 2016, Unit 42 published research on a new Hworm/Houdini variant used in multiple attacks. The report said the malware used a mixed binary-and-ASCII TCP protocol instead of the HTTP-based protocol seen in earlier versions.
Unit 42 assessed that a campaign using a new Delphi-based Hworm variant was active from at least June 2016 through mid-October 2016. The attacks used self-extracting archives with political-themed lures and decoy content while the malware executed in the background.
A password-protected beta builder for Delphi Hworm implants was uploaded to VirusTotal around October 2015. Unit 42 linked this builder to later Delphi-based Hworm development.
A user named "Houdini" posted on the Arabic-language forum dev-point[.]com around July 2015 describing plans to rewrite the backdoor in Delphi.
Hworm/njRAT was first seen in 2013 and was initially used in targeted attacks against the international energy sector in the Middle East before later becoming more broadly used.
Cofense published research describing Hworm/Houdini as part of a new phishing attack. This adds a phishing-delivery development not explicitly covered in the existing timeline.
Morphisec Labs reported a newly observed Hworm variant with a minor obfuscation change. The sample used a fileless VBScript injector with DynamicWrapperX and injected the final payload into msbuild.exe.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
cofense.com
Open sourceblog.morphisec.com
Open sourceisc.sans.edu
Open sourcemalwr-analysis.com
Open sourcegithub.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple reports documented continued **njRAT** (also known as **Bladabindi**) activity delivered through diverse infection chains, including malicious PowerPoint macros, phishing attachments, password-protected archives, trojanized software on Korean webhard sites, compiled AutoHotKey loaders, and typosquatted npm packages. The malware was shown using layered obfuscation in VBS and PowerShell, Base64-encoded payloads, reflective or in-memory loading, and staged retrieval from services such as `paste.ee`, `archive.org`, `wtools.io`, and dynamic DNS infrastructure. In one supply-chain case, the npm packages `jdb.js` and `db-json.js` installed a .NET payload that copied itself as `dchps.exe` and connected to `46.185.116.2:5552`, while other campaigns used domains including `fidapeste2.duckdns.org`, `xxxcarldon.duckdns.org`, and `0.tcp.eu.ngrck.io` for command and control. Analysis of multiple samples showed njRAT maintaining persistence through **Startup folder** copies, **registry Run keys**, shortcuts, mutexes, firewall-rule changes, and even `netsh` exclusions, while some variants bundled legitimate applications so victims would not notice the infection. Once active, the RAT collected host profiling data and supported a broad set of attacker functions, including **keylogging, credential theft, webcam access, screenshot and screen viewing, file transfer, process and registry manipulation, remote shell access, and full remote control** of Windows systems. Reports also linked njRAT delivery to long-running loader ecosystems that rotated payload families such as Houdini, LimeRAT, RevengeRAT, AsyncRAT, and VjW0rm, underscoring the malware’s persistence as a flexible commodity RAT used across phishing, malware-hosting, and software supply-chain abuse.
Aug 15, 2026
Researchers reported that **XWorm**, a .NET-based Windows remote access trojan, has been both actively deployed in phishing attacks and marketed online as a builder for criminal operators. The malware has been advertised with modules for **RAT control, ransomware, HVNC, hidden RDP, DDoS, keylogging, credential theft, clipper functions, and persistence**, while incident analysis found live samples communicating with command-and-control servers such as `system6458[.]ddns[.]net` over port `6666`. Reverse engineering also showed that XWorm uses anti-analysis checks to terminate in virtualized or sandboxed environments and can persist through startup-folder copies, scheduled tasks, AppData placement, and registry autorun entries. Separate investigations tied XWorm to ongoing delivery campaigns, including the **MEME#4CHAN** phishing operation, which used fake hotel reservation lures and Microsoft Word documents exploiting `CVE-2022-30190` to launch multi-stage infection chains involving PowerShell, JScript, and in-memory .NET loading. Analysts found XWorm variants capable of **PowerShell execution, in-memory .NET execution, screenshots, plugin retrieval, USB spreading, uninstall functions, and DDoS**, with configuration fields such as `Host`, `Port`, and `KEY` encrypted using AES and derived keys. In some intrusions, the malware disabled **AMSI**, weakened Microsoft Defender, created a local administrator account named **System32**, disabled the Windows Firewall, and injected the final payload into processes including `RegSvcs.exe` and `Msbuild.exe`, with observed C2 infrastructure including `212.87.204[.]83:3000` and `port3000newspm.duckdns[.]org`.
Aug 15, 2026
Researchers reported that malicious email attachments disguised as JavaScript files were being used to deliver a broad set of remote access Trojans and stealers through heavily obfuscated loader chains. HP Wolf Security identified the activity as **RATDispenser**, a stealthy JavaScript loader that decodes itself, launches `cmd.exe`, writes a VBScript file into `%TEMP%`, and then either drops or downloads a second-stage payload. Analysis of 155 samples found that **94%** acted as droppers rather than network downloaders, with **STRRAT** and **WSHRAT** making up **81%** of observed payloads; other delivered malware included **Formbook**, **Remcos**, **AdWind**, **Panda Stealer**, **GuLoader**, and **Ratty**. The campaign’s low average detection rate and layered obfuscation indicated an effective distribution mechanism for commodity malware. Separate analysis of a phishing campaign targeting European organizations showed a similar JavaScript-to-VBS infection pattern delivering **H-Worm/Houdini** after emails impersonating entities such as **UNWTO** and **IATA**. Lab52 attributed that operation to **LazyScripter** and found that the attackers’ obfuscated scripts had themselves been tampered with by the online service `hackfree.org`, which injected an additional **njRAT** downloader, creating a double-compromise scenario. Researchers linked the primary campaign to infrastructure including `stub.ignorelist.com` and `securessl.fit`, while the injected secondary activity used a PowerShell downloader that contacted `185.81.157.186` to retrieve content from `/NDA/199.png`, underscoring how obfuscated JavaScript loaders were being reused to distribute multiple RAT families through phishing.
Aug 15, 2026