Ukraine Warns of Weaponized XLL Files Delivering CABINETRAT Malware via Zip Archives

Ukraine’s national cyber incident response team, CERT-UA, has issued an alert regarding a new malware campaign utilizing Excel add-in (XLL) files to deploy the CABINETRAT backdoor.

In September 2025, CERT-UA identified several malicious XLL files disguised as harmless documents. Examples include “Звернення УБД.xll” and “recept_ruslana_nekitenko.xll,” which leverage Excel’s Add-in Manager and the xlAutoOpen export function for execution on target systems.

The campaign has expanded beyond email lures. Intelligence indicates that attackers distributed a ZIP archive named “500.zip,” masquerading as a document about arrests at Ukraine’s border. This archive contains “dodatok.xll,” a malicious add-in that delivers several payloads to the victim’s machine, including:

A randomly named executable (internally referred to as “runner.exe”) placed in both %APPDATA%\Microsoft\Office\ and the user’s Startup folder. A loader XLL file named “BasicExcelMath.xll” (internal name “loader.xll”) located in %APPDATA%\Microsoft\Excel\XLSTART\ . A PNG image “Office.png” containing the CABINETRAT shellcode.

The malware ensures persistence by creating a random registry key in HKCU\...\Run and scheduling an hourly task under a random name to execute the dropped executable with limited privileges. It verifies the Excel path using HKLM\...\App Paths\EXCEL.EXE and clears entries in the DisabledItems registry branches for Office versions 14.0, 15.0, and 16.0.

Launching Excel with the /e parameter causes the “BasicExcelMath.xll” file to auto-load without showing a new workbook. It reads “Office.png,” decrypts the embedded shellcode, and invokes it using VirtualProtect and CreateThread . CERT-UA confirmed the shellcode as the CABINETRAT backdoor, a comprehensive malware written in C that facilitates information gathering, command execution, file operations, screenshot capture, and TCP communication.

Network Behavior and Detection Evasion

CABINETRAT employs a network protocol resembling port knocking, attempting connections on ports 18700, 42831, 20046, and 33976 before establishing a TCP channel. Once connected, it exchanges INIT packets, compresses data using MSZIP, and fragments payloads exceeding 65,535 bytes. It supports remote program execution, command output exfiltration, file transfer, BIOS GUID reporting, registry and disk enumeration, installed programs listing, directory listing, screenshot capture, error reporting, and file deletion.

To evade detection, all XLL components and the shellcode implement anti-VM and anti-analysis checks, verifying the absence of wine_get_unix_file_name in kernel32.dll, inspecting BIOS tables for virtualization vendors, and more. Strings and code are obfuscated with 32-bit index tables referencing hidden data arrays.

Given the novelty of these tactics and techniques, CERT-UA has designated a new identifier, UAC-0245, for tracking this campaign. Indicators of compromise include numerous SHA-256 hashes for malicious XLL, EXE, PNG, and ZIP files, as well as registry keys, scheduled task names, file paths under %APPDATA% and %LOCALAPPDATA% , and the IP addresses 20[.]112.250.113 and 20[.]70.246.20 on ports 443 and 433.

Organizations and individuals should block or closely monitor Excel add-in loading, scrutinize suspicious ZIP attachments, and apply network rules to restrict outbound traffic to the noted IP addresses. Regularly updating endpoint security solutions to detect CABINETRAT signatures and enabling macro-execution restrictions within Office applications are recommended as critical defenses against this evolving threat.

Based on reporting by GBHackers.