Threat reportMalwareTL-2026-3749
XWorm RAT C2 panel unauthenticated RCE via path traversal and DLL hijack (versions up to 7.4) with public PoC
XWorm RAT C2 panel unauthenticated RCE via path traversal (TL-2026-3749), also tracked as XWorm 7.4 C2 panel RCE, is a high-severity malware campaign, first published 2026-10-16. It has no confirmed attribution, affects XCoderTools / XCoder (malware author) XWorm RAT C2 panel (controller), maps to 16 MITRE ATT&CK techniques (T1055, T1056.001, T1059.001), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-3749
- Threat ID
- TL-2026-3749
- Also known as
- XWorm 7.4 C2 panel RCE
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in XWorm RAT C2 panel unauthenticated RCE via path traversal
Malware and tooling: NoCry, XWorm
How XWorm RAT C2 panel unauthenticated RCE via path traversal works
An independent researcher, Mootoo, published a PoC for an unauthenticated remote code execution flaw in the XWorm RAT C2 panel (versions up to 7.4). Anyone with the panel address, port and communication key can impersonate an infected client and run code on the operator's host. SecurityWeek reports limited-scale exploitation; the flaw was found on October 4, 2026.
XWorm is a commodity, modular .NET remote access trojan sold to criminal operators. Its operator-side C2 panel (the controller GUI) receives connections from infected clients on a configurable TCP port. The PoC repository describes a default panel port of 1723 and a default key of <V74PV74PV74PV74P> for version 7.4. Traffic is encrypted with AES-128-ECB using a key derived from the MD5 of the communication key. Because the panel accepts any client that can encrypt with that key, there is no real authentication of the peer.
The PoC emulates an infected client. It sends an INFO packet with crafted victim metadata to complete the handshake. It then opens a FileM (file manager) session whose directory argument is '..' and sends a 'downloadedfile' packet naming ../FastColoredTextBox.dll. The panel's file-receive logic does not validate the path, so the upload lands in the panel's root directory and overwrites the legitimate FastColoredTextBox.dll, a .NET syntax-highlighting library. Finally the fake client sends a 'Compiler' command, which makes the panel open its compiler interface and load the attacker-supplied DLL. This runs attacker code on the C2 host with no operator action beyond the panel running. The PoC classifies the bug as CWE-23 (relative path traversal) combined with CWE-427 (uncontrolled search path element). No CVE has been assigned.
Mootoo, an independent researcher in Oman, found the flaw while reverse-engineering an XWorm sample used in an attack against them. They reportedly used it to compromise infrastructure tied to the person behind that attack (SecurityWeek). SecurityWeek assesses exploitation as limited in scope, but the public PoC lowers the barrier for other actors, including defenders, rival criminals and researchers. An earlier RCE in XWorm V5.6 and earlier, exploitable with the C2 encryption key, was also publicly disclosed. The V6 line was marketed as 'RCE-fixed', and V6 changed the default key from <123456789> to <666666>.
Defender relevance: this is a vulnerability in attacker tooling, not in a victim product. The defensive value is for hunting, takedown and attribution work. Organizations running XWorm panels (including researcher-operated honeypots or sinkholes) should know the panel is itself exploitable. Defenders can use the known XWorm client behavior, such as Run key persistence, RegSvcs.exe injection, the plugin DLLs and AMSI bypass, for endpoint detection. The sources reviewed did not publish any panel hostnames, hashes or victim-side IOCs for the exploitation itself.
MITRE ATT&CK techniques used in TL-2026-3749
Defense Evasion
T1055 Process Injection; T1218.009 System Binary Proxy Execution: Regsvcs/Regasm
Collection
T1056.001 Input Capture: Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture; T1185 Browser Session Hijacking
Execution
T1059.001 Command and Scripting Interpreter: PowerShell
Initial Access
T1190 Exploit Public-Facing Application; T1566.001 Phishing: Spearphishing Attachment
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Credential Access
T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Command and Control
T1573.001 Encrypted Channel: Symmetric Cryptography
stealth
T1574.001 Hijack Execution Flow: DLL
Resource Development
T1587.004 Develop Capabilities: Exploits
defense-impairment
Affected products and versions in XWorm RAT C2 panel unauthenticated RCE via path traversal
- XCoderTools / XCoder (malware author) — XWorm RAT C2 panel (controller)
Vulnerable versions: up to and including 7.4
Remediation for XWorm RAT C2 panel unauthenticated RCE via path traversal
Patches
- No vendor patch applies. XWorm is criminal malware and the affected panel is up to version 7.4
Immediate actions
- Treat any host running an XWorm 7.4-or-earlier panel as exploitable by anyone who knows the panel address, port and key
- Hunt for XWorm client activity (Run key persistence, RegSvcs.exe injection, plugin DLLs such as Shell.dll and FileManager.dll) and isolate affected endpoints
- Block and monitor outbound connections to known XWorm C2 endpoints such as 94.159.113.64:4411
Workarounds
- Researchers or defenders running panel sinkholes should not expose them to untrusted networks and should monitor for FastColoredTextBox.dll modification in the panel directory
Longer-term hardening
- Deploy EDR with behavioral detection for fileless .NET RAT loaders, AMSI bypass and process injection
- Enforce email attachment and script-execution controls (JavaScript/WSH) to block the phishing delivery chain
Weaknesses (CWE) in XWorm RAT C2 panel unauthenticated RCE via path traversal
Timeline of XWorm RAT C2 panel unauthenticated RCE via path traversal
- XWorm first observed in the wild in 2022 (SecurityWeek). Only the year is stated, so the date is a placeholder for the year.
- A cracked XWorm builder was released publicly in June 2025 (SecurityWeek). Day not stated.
- XWorm V6 was released by the account 'XCoderTools' and marketed as re-coded and RCE-fixed. The one-time lifetime price was reportedly $500 (Picus).
- XWorm reached 35 supported plugins in July 2025 (SecurityWeek, The Hacker News). Day not stated.
- Source code for XWorm v6.4 leaked in August 2025 (SecurityWeek), followed by a surge in activity. Day not stated.
- Picus Security published a technical analysis of XWorm V6, covering its plugins, AMSI bypass, RegSvcs.exe injection, Ransomware.dll and observed C2 94.159.113.64:4411.
- SecurityWeek reported XWorm at 46 plugins, with new surveillance plugins (Maps, Microphone, HBrowser, Webcam) and over 1,200 incidents across 100 organizations in Q3. Day not stated.
- Mootoo reportedly used the flaw to compromise infrastructure tied to the person behind the attack. The date of use is not stated; 2026-10-04 is the discovery date.
- Researcher Mootoo discovered the unauthenticated RCE in the XWorm C2 panel while reverse-engineering an XWorm sample used in an attack against them (SecurityWeek).
- SecurityWeek reported the Mootoo PoC (github.com/mootoo11/xworm-7.4-RCE-PoC) and assessed exploitation as limited in scope.
Sources cited for XWorm RAT C2 panel unauthenticated RCE via path traversal
- SecurityWeek: In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
- SecurityWeek: XWorm RAT Evolves Into Surveillance Platform
- mootoo11/xworm-7.4-RCE-PoC (GitHub PoC)
- Picus Security: XWorm Rises Again: Dissecting the Modular Malware's V6 Resurrection
- Huntress Threat Library: XWorm Malware
- Trellix: XWorm V6: Exploring Pivotal Plugins
- The Hacker News: XWorm 6.0 Returns with 35 Plugins
Detection coverage for TL-2026-3749
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3749 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.