VOID#GEIST Multi-RAT Campaign — Early Bird APC Injection Delivering XWorm, AsyncRAT, and Xeno RAT via Python Runtime — Threadlinqs Intelligence
As of 2026-05-30, VOID#GEIST Multi-RAT Campaign — Early Bird APC Injection Delivering XWorm, AsyncRAT, and Xeno RAT via Python Runtime is a high-severity malware threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 33 indicators of compromise.
Threat ID: TL-2026-0196 · Severity: HIGH · Status: MONITORING · Category: MALWARE
Attribution: N/A · UNKNOWN
Multi-stage fileless malware campaign tracked as VOID#GEIST by Securonix deploys XWorm, AsyncRAT, and Xeno RAT through obfuscated batch scripts that stage a legitimate embedded Python runtime to
VOID#GEIST is a sophisticated multi-stage malware campaign discovered by Securonix Threat Research (researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee) and disclosed on March 6, 2026. The campaign demonstrates a significant evolution in script-based malware delivery, shifting away from standalone executables toward complex, modular frameworks that closely mimic legitimate user activity.
The attack chain begins with phishing emails containing links to obfuscated batch scripts hosted on TryCloudflare tunnel domains. Upon execution, the initial batch script performs several actions in parallel: it displays a decoy PDF document in full-screen Google Chrome to distract the user, launches a hidden PowerShell process using the -WindowStyle Hidden parameter to suppress console visibility, and deploys a second batch script to the Windows user Startup directory for persistence.
The malware then contacts TryCloudflare infrastructure to retrieve ZIP archives containing the core payload components: runn.py (a Python-based loader for decryption and injection), encrypted shellcode blobs (new.bin for XWorm, xn.bin for Xeno RAT, pul.bin for AsyncRAT), and JSON key files (a.json, n.json, p.json) containing the decryption keys for each respective payload.
A critical component of the staging phase involves downloading a legitimate Python runtime from python.org, creating a fully self-contained execution environment that eliminates dependencies on the target system. This approach provides portability and reliability for payload execution while appearing benign to security tools that whitelist Python processes.
The runn.py script orchestrates the final payload execution using Early Bird Asynchronous Procedure Call (APC) injection — a variant of process injection mapped to MITRE ATT&CK T1055.004. This technique creates suspended explorer.exe processes, writes decrypted shellcode into their address space, queues the shellcode via QueueUserAPC, and resumes the thread. Because injection occurs before the process entry point and before anti-malware hooks are established, this technique has a higher likelihood of evading AV/EDR detection.
XWorm is deployed first via Early Bird APC injection into explorer.exe. Xeno RAT follows, launched through the legitimate Microsoft binary AppInstallerPythonRedirector.exe to invoke Python — a living-off-the-land technique that abuses trusted system binaries. AsyncRAT is injected last using the same Early Bird APC mechanism.
The infection chain culminates with a minimal HTTP beacon transmitted to attacker-controlled C2 infrastructure hosted on TryCloudflare to confirm successful compromise. The use of TryCloudflare for both payload hosting and C2 provides significant advantages: traffic appears as legitimate HTTPS communication to Cloudflare CDN, benefits from trusted TLS certificates, and many organizations do not explicitly block or monitor trycloudflare.com traffic.
The three RAT payloads provide comprehensive remote access capabilities: XWorm offers keylogging, screenshot capture, webcam access, credential theft, and plugin-based extensibility (35+ plugins in recent versions); AsyncRAT provides real-time monitoring, screen capture, keylogging, file management, and encrypted C2 channels; Xeno RAT delivers HVNC (Hidden Virtual Network Computing), live microphone recording, reverse proxy, and SOCKS5 capabilities.
The campaign operates entirely within user privilege context — no privilege escalation, system-wide registry modifications, scheduled tasks, or service installations are required, making it harder to detect through traditional privilege-based monitoring. Repeated process injection into explorer.exe within short time windows is the strongest behavioral indicator for detection.
---
**Revalidated on 2026-03-12**
No changes to the description are warranted. The existing description accurately covers: (1) the full attack chain from phishing through batch script to Python loader to APC inject
Target sectors: government, financial, technology, healthcare, manufacturing, energy
Target regions: North America, Europe, Asia Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 33 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.002, T1059.003, T1059.006, T1059.001, T1204.002, T1106, T1547.001, T1055.004, T1027, T1140