Loading story…
Palo Alto Networks Unit 42 reported that the xHunt campaign deployed CASHY200, a PowerShell-based backdoor that used DNS tunneling for command-and-control and data exfiltration against organizations in Kuwait, including government entities. The malware communicated through DNS A queries and responses to infrastructure including windows64x[.]com, encoding commands and stolen data in subdomains with sequence numbers and command values such as 48, 92, and in older variants 200.
Investigators linked the activity to earlier xHunt infrastructure associated with Sakabota C2 operations and said the campaign ran from spring 2018 through 2019. Delivery methods included malicious Word documents and executable droppers using lures themed around Kuwait government organizations, and Unit 42 said a Kuwait-based victim’s malicious DNS tunneling traffic was blocked by DNS Security in September 2019, cutting off the attackers’ access to compromised systems.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
On September 16, 2019, a Kuwait-based organization enabled DNS Security, which detected malicious DNS tunneling activity within minutes. Blocking access to windows64x[.]com disrupted the threat actor's communications with compromised systems.
In September 2019, a host in Kuwait was observed beaconing to windows64x[.]com using the same DNS tunneling protocol as CASHY200. The sample appeared tailored to the compromised host because its unique hostname value was hardcoded.
Researchers observed the domain windows64x[.]com being used in June 2019 as a command-and-control server for CASHY200. They also linked the domain to pasta58[.]com, which had been associated with Sakabota C2 activity.
On May 14, 2019, an individual posted on Microsoft TechNet about suspicious tunneling activity involving windows64x[.]com on two servers. The activity matched the same DNS tunneling protocol later seen in the Kuwait intrusion.
On June 3, 2018, researchers observed another executable that installed and executed CASHY200. This sample used firewallsupports[.]com for command-and-control communications.
On May 1, 2018, researchers observed an executable that installed and executed a CASHY200 PowerShell script. The malware communicated with the command-and-control domain windows-updates[.]com.
Researchers found evidence that the threat group used the CASHY200 PowerShell backdoor against Kuwait organizations, including government entities, starting in spring 2018. The campaign continued through 2019 and overlapped with prior xHunt activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 35 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers found the **xHunt** threat actor using a newly identified ASPX webshell called **BumbleBee** on a compromised Microsoft Exchange server and several internal IIS servers at organizations in Kuwait. The webshell supported command execution and file upload and download, and was used alongside account and network discovery activity to expand access inside victim environments. Investigators said the actor also monitored compromised Outlook Web App mailboxes, including helpdesk and security alert accounts, to track defensive responses and maintain persistence. The intrusions also involved **Plink**-based SSH tunnels that gave the actor access to internal systems over **RDP** and **HTTP**, enabling lateral movement while limiting exposure of direct attacker infrastructure. Unit 42 linked the activity to earlier xHunt operations through reused SSH credentials from the **Sakabota** cheat sheet and overlapping infrastructure, including `192.119.110[.]194`, `142.11.211[.]79`, `91.92.109[.]59`, and domains associated with `backendloop[.]online`. The actor further obscured operations by routing traffic through **Private Internet Access** VPN nodes and, in some cases, **FalcoVPN**, rotating source IP addresses across multiple European countries while maintaining long-term access to Kuwaiti targets.
Aug 14, 2026
Researchers reported renewed **SERPENTINE#CLOUD** activity using Cloudflare Tunnel-hosted **WebDAV** delivery chains, with campaigns targeting both a previously compromised organization and German-speaking small businesses. In one intrusion attempt, Huntress said the actor returned just weeks after remediation of a six-month breach and used a **ClickFix** lure to trigger `rundll32.exe` loading `davclnt.dll` and fetching content from an ephemeral Cloudflare tunnel; defenders stopped the attack before payloads reached disk. Breakglass separately observed German-language lures disguised as legal documents, where a malicious `.lnk` file opened a legitimate invoice PDF as a decoy while staging scripts and downloading a clean Python runtime from `python.org`. Across both investigations, the operator reused a stable toolchain built around Python loaders and **Donut** shellcode while varying payloads and delivery details to evade detection. Huntress linked the latest attempt to prior activity through reused GUIDs, encryption material, loader templates, staging paths, DuckDNS infrastructure, and command-and-control consolidation to two AT&T residential IPs in Chicago; the payload set included **VenomRAT**, **AsyncRAT**, **XWorm/Violet**, **PureHVNC**, and a **Brute Ratel C4** wrapper. Breakglass found a custom Donut variant using a non-standard big-endian **Chaskey-CTR** counter and dual deployment of **dcRAT** and **XenoRAT v1.8.7** into separate `explorer.exe` processes via Early Bird APC injection, with a live XenoRAT server at `176.96.136[.]182`; researchers said the actor continues to rotate infrastructure quickly while preserving recognizable patterns such as WsgiDAV behind Cloudflare Quick Tunnels and a WebDAV share named **Music**.
Jun 29, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026