New XWorm RAT Campaign Uses Themed Phishing Lures and CVE‑2018‑0802 Excel Exploit to Evade Detection
A recent phishing campaign has been identified, deploying an updated version of XWorm, a Remote Access Trojan (RAT) that enables attackers to gain full control over compromised Microsoft Windows systems.
A recent phishing campaign has been identified, deploying an updated version of XWorm, a Remote Access Trojan (RAT) that enables attackers to gain full control over compromised Microsoft Windows systems.
Originally tracked in 2022, XWorm continues to be actively distributed, often through Telegram-based marketplaces , making it accessible to numerous threat actors.
The latest campaign employs business-themed emails, including payment detail reviews, purchase orders, and signed shipment documents, to deceive targets into opening a malicious Excel add-in attachment (.XLAM).
Upon opening the attachment, the attack progresses swiftly from document execution to in-memory malware delivery, increasing risks such as account theft and data loss.
The analysis indicates an embedded OLE object set to auto-load, leading to shellcode execution upon opening the file.
Fortinet researchers documented this campaign, highlighting the use of a crafted Excel file that exploits CVE‑2018‑0802, a Microsoft Equation Editor (EQNEDT32.EXE) remote code execution vulnerability. The analysis indicates an embedded OLE object set to auto-load, leading to shellcode execution upon opening the file.
Upon triggering CVE‑2018‑0802, the shellcode downloads an HTA from retrodayaengineering[.]icu/HGG.hta, saves it as %APPDATA%\VA5.hta, and launches it using ShellExecuteExW. This transition shifts the attack from a document exploit to script-based execution, concealing malicious activities within normal Windows processes.
The obfuscated HTA runs under mshta.exe, deploying a Base64 PowerShell payload that retrieves an image file from a Cloudinary URL. This file contains a hidden .NET module, which executes filelessly in memory, evading early-stage detection.
The .NET loader decodes a reversed Base64 URL, retrieves wwa.txt from pub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev, reconstructs the XWorm payload in memory, and injects it into Msbuild.exe using process hollowing. The RAT then decrypts its configuration and connects to berlin101[.]com:6000 using AES-encrypted traffic.
Organizations are advised to prioritize patching the Equation Editor vulnerability, restrict or isolate .XLAM/HTA execution paths, tighten controls on mshta.exe, PowerShell, and Msbuild.exe, and implement detections for the mentioned domains and URLs.
Based on reporting by Cyber Security News.