Loading story…
Researchers reported that XWorm, a .NET-based Windows remote access trojan, has been both actively deployed in phishing attacks and marketed online as a builder for criminal operators. The malware has been advertised with modules for RAT control, ransomware, HVNC, hidden RDP, DDoS, keylogging, credential theft, clipper functions, and persistence, while incident analysis found live samples communicating with command-and-control servers such as system6458[.]ddns[.]net over port 6666. Reverse engineering also showed that XWorm uses anti-analysis checks to terminate in virtualized or sandboxed environments and can persist through startup-folder copies, scheduled tasks, AppData placement, and registry autorun entries.
Separate investigations tied XWorm to ongoing delivery campaigns, including the MEME#4CHAN phishing operation, which used fake hotel reservation lures and Microsoft Word documents exploiting CVE-2022-30190 to launch multi-stage infection chains involving PowerShell, JScript, and in-memory .NET loading. Analysts found XWorm variants capable of PowerShell execution, in-memory .NET execution, screenshots, plugin retrieval, USB spreading, uninstall functions, and DDoS, with configuration fields such as Host, Port, and KEY encrypted using AES and derived keys. In some intrusions, the malware disabled AMSI, weakened Microsoft Defender, created a local administrator account named System32, disabled the Windows Firewall, and injected the final payload into processes including RegSvcs.exe and Msbuild.exe, with observed C2 infrastructure including 212.87.204[.]83:3000 and port3000newspm.duckdns[.]org.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The CERT Polska analysis documented XWorm capabilities including keylogging, USB spreading, uninstall, simple AV evasion, PowerShell execution, in-memory .NET execution, screenshots, plugin retrieval, and DDoS commands. It also listed recent XWorm C2 servers such as septiembre2022.duckdns.org:3130, 20.197.231.178:7000, and several other IP- and DuckDNS-based endpoints.
CERT Polska released a technical analysis of XWorm showing a malspam-delivered sample packed through multiple loader stages before unpacking the final .NET payload. The report explained that XWorm stores configuration in a static Settings class and encrypts fields such as Host, Port, KEY, SPL, and USBNM with AES-ECB using a key derived from the MD5 hash of the Mutex value.
The Securonix report described the campaign's post-exploitation behavior, including AMSI bypasses, Microsoft Defender exclusions, scheduled-task persistence, Startup-folder copies, and in some cases creation of a local administrator account named System32 and disabling of Windows Firewall. The final XWorm payload was observed executing in RegSvcs.exe or Msbuild.exe with C2 infrastructure including 212.87.204[.]83:3000 and port3000newspm.duckdns[.]org.
Securonix published analysis of the ongoing MEME#4CHAN campaign, which used phishing emails with malicious Word documents exploiting CVE-2022-30190 to deliver XWorm v3.1. The campaign used hotel-booking lures, targeted organizations including German businesses, and chained external relationship objects, PowerShell, JScript, and .NET loaders.
In the same analysis, Cyble said it identified active XWorm instances in the wild and described the malware as more prevalent and sophisticated than other EvilCoder Project samples it found. The report documented anti-analysis checks, persistence via startup folder/AppData/scheduled tasks/registry, and C2 communications to system6458[.]ddns[.]net:6666.
Cyble Research Labs discovered a dark web post advertising XWorm v2.2 and other offensive tools sold by a malware developer operating the EvilCoder Project website. The listing marketed XWorm as a .NET builder with RAT, ransomware, HVNC, hidden RDP, DDoS, keylogging, credential theft, clipper, and persistence features.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cert.pl
Open sourcesecuronix.com
Open sourceblog.cyble.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported evolving **multi-stage, script-heavy infection chains** used to deliver remote access trojans, including **XWorm**, **AsyncRAT**, and **Xeno RAT**. Securonix described a campaign dubbed **VOID#GEIST** that starts from phishing-delivered batch scripts fetched from *TryCloudflare* infrastructure, then chains additional batch/PowerShell stages, deploys a legitimate embedded Python runtime, decrypts shellcode, and executes it filelessly by injecting into `explorer.exe` using **Early Bird APC injection**, reducing disk artifacts and making each stage appear benign in isolation. Separately, SANS ISC documented another **XWorm** wave using an obfuscated JavaScript-to-PowerShell loader chain that drops a temporary PowerShell script (e.g., `C:\Temp\ps_...ps1`), decodes additional in-memory PowerShell, and uses a DLL exporting `ProcessHollowing` to inject the XWorm client into a .NET compiler process. The write-up included configuration and IOCs such as a C2 endpoint `204[.]10[.]160[.]190:7003`, mutex `Cqu1F0NxohroKG5U`, and multiple SHA-256 hashes for the JavaScript, PowerShell, DLL loader, and XWorm payload, indicating continued high-volume distribution with frequently changing delivery techniques.
Jun 29, 2026
Researchers detailed two XWorm delivery operations that relied on multi-stage loaders, in-memory execution, and **AMSI bypasses** to evade detection. In one campaign attributed to **TAG-124**, compromised legitimate websites redirected selected victims into a PowerShell chain that patched `clr.dll` to disable `AmsiScanBuffer`, suppressed PowerShell history, disabled ETW, fingerprinted hosts, and pulled an XOR-encrypted payload from `sellmeyourbiz[.]com`, ultimately delivering **XWorm RAT**. Breakglass reported low initial detection rates and observed victim-specific beaconing under `/customers/`, with encoded host details including hostname, domain, username, process ID, campaign ID, and hardware UUID. A separate three-stage intrusion used a VBScript lure, `Projet20Immobilier.vbs`, masquerading as a French real-estate document to deploy **XWorm V5.6** through a .NET loader and process injection into `InstallUtil.exe`. Breakglass assessed the operator was likely Brazilian based on Portuguese-language code artifacts and found the same infrastructure also hosted a Portuguese carding marketplace, **Iluminat Store infosCC**, suggesting a vertically integrated criminal pipeline that steals credentials and payment data with XWorm and monetizes them directly through fraud services. The malware infrastructure included servers on DigitalOcean and Contabo, and the sample used the default XWorm encryption key `<123456789>`, exposing weak operator OPSEC despite capabilities that included keylogging, screenshot capture, DNS hijacking, persistence, and ransomware plugin support.
Jun 29, 2026
Researchers reported that **XWorm** re-emerged with the release of **XWorm V6** after the malware had been widely considered abandoned, and that its latest campaigns used a modular plugin architecture to expand capabilities on infected Windows systems. In one observed chain, a malicious JavaScript file launched PowerShell, disabled AMSI, deployed an injector DLL, and injected the XWorm client into `RegSvcs.exe`, after which the malware contacted a command-and-control server at `94.159.113.64:4411`. The malware stored plugins in the registry and retrieved them on demand to enable remote desktop control, shell access, credential theft, browser data theft, file management, persistence, and ransomware activity; researchers also linked some browser-theft components to public proof-of-concept code designed to bypass Chrome v20 protections. Separate reporting found that threat actors were circulating a **trojanized XWorm builder**, underscoring infighting in the cybercrime ecosystem and showing that some operators and would-be customers were themselves being infected. Trellix likewise observed cracked and modified XWorm V6 builders, including leaked **V6.4** variants containing `Rootkit.dll` and `ResetSurvival.dll`, and said some builders and operators had been compromised by XWorm malware. The malware’s persistence methods included logon scripts, **Run** keys, and abuse of `ResetConfig.xml`, while operators also deployed payloads such as **DarkCloud Stealer**, **Remcos RAT**, and other stealers; its ransomware plugin used **AES-CBC**, dropped a ransom note, changed the victim’s wallpaper, and showed code overlap with **NoCry** ransomware.
Aug 14, 2026