XWorm RAT Deploys New Stagers and Loaders to Bypass Defenses

The XWorm Remote Access Trojan (RAT), a longstanding favorite among cybercriminals, has recently showcased a significant evolution in its attack methodology, employing an array of sophisticated stagers and loaders to evade detection and infiltrate systems.

Known for its comprehensive malicious capabilities including keylogging, remote desktop access, data exfiltration, and command execution XWorm has become a versatile tool in the arsenal of threat actors targeting sectors like the software supply chain and gaming industry.

Evolving Tactics in Cybercriminal Toolkits

Its developers continuously update the malware, enhancing its adaptability and making it a persistent challenge for cybersecurity defenses.

In a notable campaign, attackers have paired XWorm with AsyncRAT as initial-stage malware to establish footholds in victim environments, subsequently deploying ransomware payloads crafted with the leaked LockBit Black builder, highlighting tactical similarities with the notorious LockBit ransomware group.

Unlike traditional malware that often follows a predictable infection chain, XWorm’s latest iterations leverage a dynamic approach to payload delivery, cycling through an assortment of file formats and scripting languages such as PowerShell, VBS, .NET executables, JavaScript, batch scripts, and even Office macros.

This variety, often delivered through phishing campaigns via email attachments or embedded lure documents, includes file types like ZIP archives and .hta or .lnk files, designed to bypass endpoint security and sandboxing tools.

Dynamic Delivery Mechanisms

Analysis of over 1,000 samples from Malware Bazaar by the Splunk Threat Research Team (STRT) reveals common phishing lures mimicking urgent business communications such as invoices and shipping notifications to trick users into executing malicious files.

Beyond initial access, XWorm employs advanced obfuscation in its stagers and loaders, using Base64 encoding and AES encryption to conceal functionality, and tampers with Windows security features like AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) to suppress detection and logging.

These tactics, combined with persistence mechanisms like registry run keys, scheduled tasks, and startup folder shortcuts, ensure sustained access and potential privilege escalation within compromised systems.

XWorm’s payload further demonstrates its sophistication by conducting detailed system reconnaissance querying Windows Management Instrumentation (WMI) for antivirus software, GPU details, and video capture drivers while attempting to disable Microsoft Defender through exclusion settings.

Its ability to spread via removable media and execute backdoor commands from C2 servers, alongside process injection and DLL side-loading techniques, amplifies its threat profile.

To combat this evolving menace, STRT has developed a range of Splunk detections targeting suspicious activities such as PowerShell execution policy bypasses, renamed PowerShell instances, and unusual command-line tool executions, providing critical tools for security teams to identify and mitigate XWorm infections.

Indicators of Compromise (IOC)

Exclusive Webinar Alert: Harnessing Intel® Processor Innovations for Advanced API Security – Register for Free