XWorm v6.4 Delivery Campaign — Obfuscated JavaScript/PowerShell Loaders with ProcessHollowing DLL Injection (March 2026)

XWorm v6.4 Delivery Campaign (TL-2026-0180), also tracked as XWorm, is a high-severity malware campaign, first published 2026-03-06. It has no confirmed attribution, affects Microsoft Windows, maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-0180

Threat ID
TL-2026-0180
Also known as
XWorm, XWorm v6.4, XWorm RAT
Severity
HIGH
Status
MONITORING
Category
MALWARE
First published
2026-03-06
Last reviewed
2026-03-06
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
financial, manufacturing, logistics, retail, healthcare, technology, government
Target regions
North America, Europe, Asia Pacific
Detection rules
9
Indicators of compromise
19

Malware and tooling in XWorm v6.4 Delivery Campaign

Malware and tooling: XWorm, DonutLoader, XWorm C2

Active XWorm v6.4 malware delivery campaign using obfuscated JavaScript email attachments (fake invoice/packing list lures) that drop PowerShell loaders performing Base64+XOR decoding, deploying a DLL that uses ProcessHollowing to inject XWorm v6.4 into .NET compiler processes. C2 communicates on 204.10.160.190:7003 with AES encryption. Campaign shares infrastructure with prior Fake FedEx phishing operations.

How XWorm v6.4 Delivery Campaign works

Active XWorm v6.4 delivery campaign documented by SANS Internet Storm Center (ISC) on March 4, 2026. The attack chain begins with phishing emails containing obfuscated JavaScript attachments disguised as invoices or packing lists (e.g., "Inv-4091-CBM-4091-CUSTOM-Packing_List.js").

When executed, the JavaScript dropper writes a PowerShell loader script to the temporary directory (e.g., "ps_5uGUQcco8t5W_1772542824586.ps1"). The PowerShell loader performs multi-stage payload decoding using Base64 and XOR operations to extract the next-stage components.

The decoded payload includes a .NET DLL named "MAD.dll" that exports a function called "ProcessHollowing". This DLL acts as a loader/injector, creating a new instance of a legitimate .NET compiler process (MSBuild.exe or RegSvcs.exe) in a suspended state, hollowing out its memory, and injecting the XWorm v6.4 client payload. This process hollowing technique allows XWorm to execute within a trusted Windows process, evading application whitelisting and behavioral detection.

XWorm v6.4 is a modular Remote Access Trojan (RAT) with extensive capabilities including keystroke logging, screenshot capture, webcam access, credential theft from browsers (Chrome, Edge, Brave), file system manipulation, remote command execution, and a plugin architecture supporting dynamic loading of additional modules including ransomware (Ransomware.dll with AES-CBC encryption), shell access (Shell.dll), file management (FileManager.dll), and network monitoring (TCPConnections.dll).

The C2 server at 204.10.160.190:7003 communicates using AES-encrypted channels with the key "XAorWEAzx4+ic89KWd910w==". The malware creates a mutex "Cqu1F0NxohroKG5U" to prevent multiple instances and drops a copy as "USB.exe" for persistence and USB spreading.

Persistence is achieved through multiple mechanisms: Windows Registry Run keys (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run), scheduled tasks, startup folder entries, and logon scripts. XWorm v6.0+ includes an AMSI bypass that modifies CLR.DLL in memory by nulling out the "AmsiScanBuffer" string. When running with administrative privileges, the malware marks itself as a critical system process, causing a system crash/reboot upon termination attempts.

Plugin storage occurs in the Windows Registry under HKCU\SOFTWARE\<CLIENT_ID> as Gzip-compressed REG_BINARY values. The modular architecture allows operators to remotely load and execute additional DLL payloads entirely in memory.

This campaign shares the same C2 infrastructure (204.10.160.190:7003) with a prior Fake FedEx phishing campaign documented by SANS ISC on February 27, 2026 (diary #32754), which used a different delivery mechanism (batch script -> PowerShell -> DonutLoader -> process injection into explorer.exe) but delivered the same XWorm variant. The infrastructure overlap indicates a persistent threat actor reusing C2 infrastructure across multiple campaign themes.

---

**Revalidated on 2026-03-12**

This threat has been fully revalidated and confirmed ACTIVE with HIGH severity maintained. The XWorm v6.4 campaign documented in TL-2026-0180 is corroborated by the original SANS ISC diary (March 4, 2026) and represents one wave in a sustained XWorm offensive that has escalated dramatically since V6.0's release in June 2025. Key revalidation findings:

**Threat Evolution**: XWorm has progressed from V5.6 (retired late 2024) through V6.0 (June 2025), V6.4 (documented here), V6.5, to V7.2 (late 2025/early 2026). Each version enhanced evasion capabilities while maintaining the core ProcessHollowing injection technique used in this campaign. V6.0+ introduced 35+ plugins including ransomware (NoCry overlap), HVNC, DDoS, USB propagation, and cryptocurrency clipboard hijacking. The plugin architecture now supports 50+ modules.

**Parallel Active Campaigns (January-March 2026)**: Multiple concurrent XWorm campaigns are active: (1) LATAM-targeting fake Bradesco bank receipt campaign using steganographic Cloudinary CDN delivery and CasPol.exe injection (ANY.RUN, Feb 2026); (2) Multi-themed phishing delivering XWorm v7.2 via CVE-2018-0802 Excel exploits with MSBuild.exe hollowing (FortiGuard, Feb 2026); (3) VOID#GEIST deploying XWorm alongside AsyncRAT and Xeno RAT using Early Bird APC injection into explorer.exe (Securonix, March 2026); (4) AI-assisted JavaScript/PowerShell loaders showing 'vibe-hacking' patterns (HP Wolf Security, March 2026).

**Infrastructure Expansion**: The C2 at 204.10.160.190:7003 documented in this threat is confirmed active. Additional XWorm C2 infrastructure includes berlin101.com:6000, jholycf100.ddns.com.br:7000, and 94.159.113.64:4411. Hunt.io identified 9,500+ URLs on Paste.ee abused for XWorm/AsyncRAT payload staging. Cloudinary CDN and Cloudflare R2 are being leveraged for steganographic payload delivery.

**Detection Landscape**: Splunk has published a dedicated 31-rule XWorm Analytic Story covering process injection, AMSI bypass, DLL side-loading, and persistence mechanisms. Elastic Security Labs has released YARA rules targeting the ProcessHollowing injection chain. Key detection focuses should include: suspicious child processes from wscript/cscript, PowerShell execution policy bypass, .NET assembly reflection loading, MSBuild.exe/RegSvcs.exe/CasPol.exe spawning network connections, and registry modifications under HKCU\SOFTWARE\<CLIENT_ID>.

**No Disruption**: No law enforcement action has specifically targeted XWorm infrastructure. Operation Endgame 3.0 (November 2025) disrupted adjacent RAT ecosystems (VenomRAT, Rhadamanthys) but XWorm remains unaffected. XWorm detections increased 4.3x year-over-year with a 174% surge in campaign volume, making it one of the most prevalent RAT families globally.

MITRE ATT&CK techniques used in TL-2026-0180

collection

T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1125 Video Capture

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution

exfiltration

T1041 Exfiltration Over C2 Channel

discovery

T1049 System Network Connections Discovery; T1082 System Information Discovery

execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution

command-and-control

T1071 Application Layer Protocol; T1571 Non-Standard Port; T1573 Encrypted Channel

lateral-movement

T1091 Replication Through Removable Media

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

impact

T1486 Data Encrypted for Impact

persistence

T1547 Boot or Logon Autostart Execution

credential-access

T1555 Credentials from Password Stores

initial-access

T1566 Phishing

Affected products and versions in XWorm v6.4 Delivery Campaign

  • Microsoft — Windows
    Vulnerable versions: Windows 7; Windows 8.1; Windows 10; Windows 11; Windows Server 2012; Windows Server 2016; Windows Server 2019; Windows Server 2022

Remediation for XWorm v6.4 Delivery Campaign

Immediate actions

  • Block C2 IP 204.10.160.190 at perimeter firewall
  • Block outbound connections to port 7003
  • Hunt for mutex Cqu1F0NxohroKG5U on endpoints
  • Search for USB.exe in %TEMP%, %APPDATA%, and startup directories
  • Quarantine and investigate systems with connections to 204.10.160.190
  • Block JavaScript email attachments at email gateway

Workarounds

  • Disable Windows Script Host (wscript/cscript) execution via GPO
  • Block PowerShell execution for non-administrative users
  • Restrict .js file associations to text editor instead of Windows Script Host

Longer-term hardening

  • Deploy EDR with behavioral detection for ProcessHollowing and AMSI bypass
  • Enable PowerShell script block logging and constrained language mode
  • Implement application whitelisting to restrict unsigned DLL execution
  • Deploy email attachment sandboxing for JavaScript files
  • Monitor registry Run keys and scheduled tasks for unauthorized persistence
  • Implement network segmentation to limit lateral movement
  • Enable AMSI integration across all endpoints

Timeline of XWorm v6.4 Delivery Campaign

Showing the 20 most recent tracked events.

  • Hunt.io uncovers campaign abusing Paste.ee platform to distribute XWorm and AsyncRAT payloads across global C2 infrastructure, with 9,500+ infected URLs identified spanning Germany, US, and offshore hosting [Source: https://hunt.io/blog/pasteee-xworm-asyncrat-infrastructure]
  • XWorm v6.0 released with enhanced AMSI bypass, critical process protection, and modular plugin architecture
  • Trellix Advanced Research Center documents XWorm''s evolving infection chain shifting from predictable batch/VBS stages to deceptive tactics using disguised executables with legitimate filenames (Discord.exe, System32.exe) [Source: https://www.trellix.com/blogs/research/xworms-evolving-infection-chain-from-predictable-to-deceptive/]
  • Forcepoint X-Labs publishes analysis of XWorm v6.5 delivered via encrypted shellcode in Office .xlam OLE streams, using reflective DLL injection with steganographic payloads and C2 at berlin101.com:6000 [Source: https://www.forcepoint.com/blog/x-labs/xworm-rat-shellcode-multi-stage-analysis]
  • Trellix publishes deep analysis of XWorm V6 plugin architecture: 35+ plugins including ransomware module (NoCry code overlap), RemoteDesktop.dll, Shell.dll, FileManager.dll, and browser credential theft via merged.dll [Source: https://www.trellix.com/blogs/research/xworm-v6-exploring-pivotal-plugins/]
  • The Hacker News reports XWorm 6.0 returns with 35+ plugins and enhanced data theft capabilities including ransomware deployment and factory reset survival persistence [Source: https://thehackernews.com/2025/10/xworm-60-returns-with-35-plugins-and.html]
  • Picus Security publishes comprehensive XWorm V6 dissection covering version history, plugin architecture, C2 protocol changes (default key changed to ''<666666>''), and ResetConfig.xml persistence surviving Windows factory reset [Source: https://www.picussecurity.com/resource/blog/xworm-rises-again-dissecting-the-modular-malwares-v6-resurrection]
  • Malwarebytes analyzes fake invoice campaign delivering XWorm via deprecated VBS scripts (INV-20192,INV-20197.vbs), highlighting continued use of legacy scripting in modern attack chains [Source: https://www.malwarebytes.com/blog/threat-intel/2025/11/we-opened-a-fake-invoice-and-fell-down-a-retro-xworm-shaped-wormhole]
  • ANY.RUN identifies LATAM-targeting XWorm v5.6 campaign using fake Bradesco bank receipts (.pdf.js double extension), steganographic payload delivery via Cloudinary CDN, and CasPol.exe process injection with C2 at jholycf100.ddns.com.br:7000 [Source: https://any.run/cybersecurity-blog/xworm-latam-campaign/]
  • FortiGuard Labs publishes deep dive into XWorm v7.2 campaign using multi-themed phishing emails (payment requests, purchase orders, bank documents), CVE-2018-0802 Excel exploit, Cloudinary-hosted steganographic payloads, and MSBuild.exe process hollowing with C2 at berlin101.com:6000 [Source: https://www.fortinet.com/blog/threat-research/deep-dive-into-new-xworm-campaign-utilizing-multiple-themed-phishing-emails]
  • Gurucul publishes technical analysis of XWorm v7 RAT covering full infection chain, AES-ECB C2 protocol with MD5-hashed keys, 18 MITRE ATT&CK technique mappings, and modular plugin architecture including DDoS and ransomware capabilities [Source: https://gurucul.com/blog/xworm-v7-rat-technical-analysis-of-infection-chain-c2-protocol-and-plugin-architecture/]
  • SANS ISC documents Fake FedEx phishing campaign delivering XWorm via batch script and DonutLoader, C2 at 204.10.160.190:7003 (diary #32754)
  • HP Wolf Security March 2026 Threat Insights Report identifies AI-assisted (''vibe-hacking'') XWorm delivery campaigns using JavaScript downloaders with heavily commented PowerShell stages suggesting generative AI development [Source: https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-march-2026/]
  • SANS ISC documents active XWorm v6.4 delivery campaign (basis of TL-2026-0180) using obfuscated JavaScript/PowerShell loaders with MAD.dll ProcessHollowing injection into MSBuild.exe/RegSvcs.exe, C2 at 204.10.160.190:7003 [Source: https://isc.sans.edu/diary/32766]
  • C2 infrastructure overlap confirmed between Fake FedEx campaign (Feb 27) and invoice/packing list campaign (Mar 4), indicating same threat actor
  • File hashes, C2 IP (204.10.160.190:7003), mutex (Cqu1F0NxohroKG5U), AES key, and install filename (USB.exe) published by SANS ISC researcher Xavier Mertens
  • SANS ISC documents new XWorm v6.4 delivery campaign using obfuscated JavaScript/PowerShell loaders with ProcessHollowing DLL injection, same C2 infrastructure (diary #32766)
  • Securonix identifies VOID#GEIST campaign deploying XWorm, AsyncRAT, and Xeno RAT simultaneously via obfuscated batch scripts, embedded Python runtimes, and Early Bird APC injection into explorer.exe processes [Source: https://thehackernews.com/2026/03/multi-stage-voidgeist-malware.html]
  • Threat documented and published to Threadlinqs Intelligence Platform as TL-2026-0180
  • As of 2026-05-29, the XWorm v6.4 delivery campaign remains active: the XWorm v6.x RAT family is still distributed in-the-wild via JS-phishing, PowerShell loaders, and process hollowing into RegSvcs/MSBuild per Trellix, Picus, and Fortinet. No CVE or single actor to disrupt (commodity RAT), and newer builds (v6.5/v7.x) are incrementally superseding the specific v6.4 variant, so status is set to MONITORING.

Sources cited for XWorm v6.4 Delivery Campaign

Threats related to XWorm v6.4 Delivery Campaign

Detection coverage for TL-2026-0180

As of 2026-03-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0180 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats