Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails
A sophisticated phishing campaign delivering XWorm RAT has been identified. The attack chain begins with themed emails containing malicious Excel attachments exploiting CVE-2018-0802. When opened, the file downloads an HTA file, which executes PowerShell code to retrieve a fileless .NET module. This module then uses process hollowing to inject the XWorm payload into Msbuild.exe. XWorm 7.2 employs encrypted C2 communication and offers extensive features through plugins, including system control, data theft, DDoS capabilities, and ransomware functionality. The analysis reveals XWorm's modular architecture and advanced evasion techniques, highlighting it as a significant threat.
Pulse ID: 698b72bb0ef7655ccb36c76f
Pulse Link: https://otx.alienvault.com/pulse/698b72bb0ef7655ccb36c76f
Pulse Author: AlienVault
Created: 2026-02-10 18:02:35
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #DDoS #DataTheft #DoS #Email #Excel #InfoSec #MSBuild #NET #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #RansomWare #Worm #XWorm #bot #AlienVault
