New XWorm RAT Campaign Leverages Phishing and CVE-2018-0802 Excel Exploit to Bypass Detection
XWorm, a multi-functional .NET-based Remote Access Trojan (RAT), initially identified in 2022, continues to be actively traded on cybercrime marketplaces. It attracts both novice and experienced operators due to its comprehensive feature set and…
XWorm, a multi-functional .NET-based Remote Access Trojan (RAT), initially identified in 2022, continues to be actively traded on cybercrime marketplaces. It attracts both novice and experienced operators due to its comprehensive feature set and plugin-based architecture.
Upon deployment, XWorm enables complete remote control over compromised Windows systems, facilitating activities such as data theft, remote desktop control, distributed denial-of-service (DDoS) attacks, and ransomware execution.
The campaign commences with multiple phishing emails mimicking payment details, purchase orders, and signed documents in various languages. These emails include a malicious Excel add-in attachment designed to exploit CVE-2018-0802 in the legacy Microsoft Equation Editor component.
Research from FortiGuard Labs highlights a multi-stage phishing campaign that delivers a new variant of XWorm via malicious Excel attachments exploiting CVE-2018-0802. This memory corruption flaw in Microsoft Office allows remote code execution and remains on CISA’s Known Exploited Vulnerabilities list despite being patched.
The shellcode uses standard Windows HTTP APIs to retrieve the HTA payload and launches it via ShellExecute, integrating the initial dropper logic within the Office exploitation flow.
XWorm, a multi-functional .NET-based Remote Access Trojan (RAT), initially identified in 2022, continues to be actively traded on cybercrime marketplaces.
The downloaded HTA, executed by mshta.exe, contains obfuscated JScript that decodes and runs a Base64-encoded PowerShell command. This stage downloads a JPEG image that embeds a fileless .NET module, which is extracted and loaded directly into memory.
Upon opening the attachment, Equation Editor loads the malformed OLE object and executes shellcode to download an obfuscated HTML Application (HTA) file from a remote server.
The in-memory .NET component, appearing as a TaskScheduler-related assembly, functions as the XWorm downloader and loader. It decodes configuration data and contacts a hard-coded URL to fetch the final RAT payload. The loader performs process hollowing against Msbuild.exe, a trusted .NET component, to execute XWorm under a legitimate signed process.
Encrypted C2 Traffic, Commands, and Plugins
Captured traffic reveals that each packet includes a cleartext size prefix followed by encrypted data. Initial registration messages transmit host identifiers and system information to assist attackers in profiling victims. The malware supports commands for process and file management, system control, data theft, keylogging, DDoS, and remote shell execution.
XWorm’s capabilities are enhanced by a modular plugin framework, allowing .NET DLLs to be pushed from the C2 server. These plugins operate filelessly and communicate using an AES-protected channel, making the system adaptable and difficult to dismantle.
Defenders are advised to apply all Office patches, particularly for legacy Equation Editor components, and enforce controls around macro, OLE, HTA, and PowerShell execution. Monitoring anomalous process chains and network detection for suspicious AES-encrypted traffic can provide early indicators of XWorm activity.
Based on reporting by GBHackers.