# XWorm v6.4 Delivery Campaign — Obfuscated JavaScript/PowerShell Loaders with ProcessHollowing DLL Injection (March 2026)

> Active XWorm v6.4 malware delivery campaign using obfuscated JavaScript email attachments (fake invoice/packing list lures) that drop PowerShell loaders performing Base64+XOR decoding, deploying a DLL that uses ProcessHollowing to inject XWorm v6.4 into .NET compiler processes. C2 communicates on 204.10.160.190:7003 with AES encryption. Campaign shares infrastructure with prior Fake FedEx phishing operations.

- **Published:** 2026-03-06T12:00:00Z
- **Last reviewed:** 2026-03-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0180
- **ID:** TL-2026-0180
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Active XWorm v6.4 delivery campaign documented by SANS Internet Storm Center (ISC) on March 4, 2026. The attack chain begins with phishing emails containing obfuscated JavaScript attachments disguised as invoices or packing lists (e.g., "Inv-4091-CBM-4091-CUSTOM-Packing_List.js").

When executed, the JavaScript dropper writes a PowerShell loader script to the temporary directory (e.g., "ps_5uGUQcco8t5W_1772542824586.ps1"). The PowerShell loader performs multi-stage payload decoding using Base64 and XOR operations to extract the next-stage components.

The decoded payload includes a .NET DLL named "MAD.dll" that exports a function called "ProcessHollowing". This DLL acts as a loader/injector, creating a new instance of a legitimate .NET compiler process (MSBuild.exe or RegSvcs.exe) in a suspended state, hollowing out its memory, and injecting the XWorm v6.4 client payload. This process hollowing technique allows XWorm to execute within a trusted Windows process, evading application whitelisting and behavioral detection.

XWorm v6.4 is a modular Remote Access Trojan (RAT) with extensive capabilities including keystroke logging, screenshot capture, webcam access, credential theft from browsers (Chrome, Edge, Brave), file system manipulation, remote command execution, and a plugin architecture supporting dynamic loading of additional modules including ransomware (Ransomware.dll with AES-CBC encryption), shell access (Shell.dll), file management (FileManager.dll), and network monitoring (TCPConnections.dll).

The C2 server at 204.10.160.190:7003 communicates using AES-encrypted channels with the key "XAorWEAzx4+ic89KWd910w==". The malware creates a mutex "Cqu1F0NxohroKG5U" to prevent multiple instances and drops a copy as "USB.exe" for persistence and USB spreading.

Persistence is achieved through multiple mechanisms: Windows Registry Run keys (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run), scheduled tasks, startup folder entries, and logon scripts. XWorm v6.0+ includes an AMSI bypass that modifies CLR.DLL in memory by nulling out the "AmsiScanBuffer" string. When running with administrative privileges, the malware marks itself as a critical system process, causing a system crash/reboot upon termination attempts.

Plugin storage occurs in the Windows Registry under HKCU\SOFTWARE\<CLIENT_ID> as Gzip-compressed REG_BINARY values. The modular architecture allows operators to remotely load and execute additional DLL payloads entirely in memory.

This campaign shares the same C2 infrastructure (204.10.160.190:7003) with a prior Fake FedEx phishing campaign documented by SANS ISC on February 27, 2026 (diary #32754), which used a different delivery mechanism (batch script -> PowerShell -> DonutLoader -> process injection into explorer.exe) but delivered the same XWorm variant. The infrastructure overlap indicates a persistent threat actor reusing C2 infrastructure across multiple campaign themes.

---

**Revalidated on 2026-03-12**

This threat has been fully revalidated and confirmed ACTIVE with HIGH severity maintained. The XWorm v6.4 campaign documented in TL-2026-0180 is corroborated by the original SANS ISC diary (March 4, 2026) and represents one wave in a sustained XWorm offensive that has escalated dramatically since V6.0's release in June 2025. Key revalidation findings:

**Threat Evolution**: XWorm has progressed from V5.6 (retired late 2024) through V6.0 (June 2025), V6.4 (documented here), V6.5, to V7.2 (late 2025/early 2026). Each version enhanced evasion capabilities while maintaining the core ProcessHollowing injection technique used in this campaign. V6.0+ introduced 35+ plugins including ransomware (NoCry overlap), HVNC, DDoS, USB propagation, and cryptocurrency clipboard hijacking. The plugin architecture now supports 50+ modules.

**Parallel Active Campaigns (January-March 2026)**: Multiple concurrent XWorm campaigns are active: (1) LATAM-targeting fake Bradesco bank receipt campaign using steganographic Cloudinary CDN delivery and CasPol.exe injection (ANY.RUN, Feb 2026); (2) Multi-themed phishing delivering XWorm v7.2 via CVE-2018-0802 Excel exploits with MSBuild.exe hollowing (FortiGuard, Feb 2026); (3) VOID#GEIST deploying XWorm alongside AsyncRAT and Xeno RAT using Early Bird APC injection into explorer.exe (Securonix, March 2026); (4) AI-assisted JavaScript/PowerShell loaders showing 'vibe-hacking' patterns (HP Wolf Security, March 2026).

**Infrastructure Expansion**: The C2 at 204.10.160.190:7003 documented in this threat is confirmed active. Additional XWorm C2 infrastructure includes berlin101.com:6000, jholycf100.ddns.com.br:7000, and 94.159.113.64:4411. Hunt.io identified 9,500+ URLs on Paste.ee abused for XWorm/AsyncRAT payload staging. Cloudinary CDN and Cloudflare R2 are being leveraged for steganographic payload delivery.

**Detection Landscape**: Splunk has published a dedicated 31-rule XWorm Analytic Story covering process injection, AMSI bypass, DLL side-loading, and persistence mechanisms. Elastic Security Labs has released YARA rules targeting the ProcessHollowing injection chain. Key detection focuses should include: suspicious child processes from wscript/cscript, PowerShell execution policy bypass, .NET assembly reflection loading, MSBuild.exe/RegSvcs.exe/CasPol.exe spawning network connections, and registry modifications under HKCU\SOFTWARE\<CLIENT_ID>.

**No Disruption**: No law enforcement action has specifically targeted XWorm infrastructure. Operation Endgame 3.0 (November 2025) disrupted adjacent RAT ecosystems (VenomRAT, Rhadamanthys) but XWorm remains unaffected. XWorm detections increased 4.3x year-over-year with a 174% surge in campaign volume, making it one of the most prevalent RAT families globally.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1218 System Binary Proxy Execution
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1049 System Network Connections Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1091 Replication Through Removable Media

## Sources

- [SANS ISC Diary: Want More XWorm?](https://isc.sans.edu/forums/diary/Want+More+XWorm/32766/)
- [SANS ISC Diary: Fake FedEx Campaign (Related Infrastructure)](https://isc.sans.edu/diary/32754)
- [Picus Security: XWorm Rises Again - Dissecting the Modular Malware V6 Resurrection](https://www.picussecurity.com/resource/blog/xworm-rises-again-dissecting-the-modular-malwares-v6-resurrection)
- [Netskope: XWorm V6 Advanced Evasion and AMSI Bypass](https://www.netskope.com/blog/xworm-v6-0-enhanced-malware-protection-and-stealthy-delivery)
- [Huntress: XWorm Malware Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/xworm)
- [Splunk: XWorm Shape-Shifting Arsenal Detection Evasion](https://www.splunk.com/en_us/blog/security/xworm-shape-shifting-arsenal-detection-evasion.html)
- [Fortinet FortiGuard Labs: Deep Dive into XWorm Campaign](https://www.fortinet.com/blog/threat-research/deep-dive-into-new-xworm-campaign-utilizing-multiple-themed-phishing-emails)
- [Elastic Security Labs: Attack Chain Leads to XWorm and AgentTesla](https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla)
- [CyberSecurityNews: New XWorm V6 Variant Injects Malicious Code](https://cybersecuritynews.com/new-xworm-v6-variant-injects-malicious-code/)
- [ThreatFox IOC Database](https://threatfox.abuse.ch/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0180