# XWorm RAT C2 panel unauthenticated RCE via path traversal and DLL hijack (versions up to 7.4) with public PoC

> An independent researcher, Mootoo, published a PoC for an unauthenticated remote code execution flaw in the XWorm RAT C2 panel (versions up to 7.4). Anyone with the panel address, port and communication key can impersonate an infected client and run code on the operator's host. SecurityWeek reports limited-scale exploitation; the flaw was found on October 4, 2026.

- **Published:** 2026-10-16T14:21:14Z
- **Last reviewed:** 2026-10-16T14:21:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3749
- **ID:** TL-2026-3749
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

XWorm is a commodity, modular .NET remote access trojan sold to criminal operators. Its operator-side C2 panel (the controller GUI) receives connections from infected clients on a configurable TCP port. The PoC repository describes a default panel port of 1723 and a default key of <V74PV74PV74PV74P> for version 7.4. Traffic is encrypted with AES-128-ECB using a key derived from the MD5 of the communication key. Because the panel accepts any client that can encrypt with that key, there is no real authentication of the peer.

The PoC emulates an infected client. It sends an INFO packet with crafted victim metadata to complete the handshake. It then opens a FileM (file manager) session whose directory argument is '..' and sends a 'downloadedfile' packet naming ../FastColoredTextBox.dll. The panel's file-receive logic does not validate the path, so the upload lands in the panel's root directory and overwrites the legitimate FastColoredTextBox.dll, a .NET syntax-highlighting library. Finally the fake client sends a 'Compiler' command, which makes the panel open its compiler interface and load the attacker-supplied DLL. This runs attacker code on the C2 host with no operator action beyond the panel running. The PoC classifies the bug as CWE-23 (relative path traversal) combined with CWE-427 (uncontrolled search path element). No CVE has been assigned.

Mootoo, an independent researcher in Oman, found the flaw while reverse-engineering an XWorm sample used in an attack against them. They reportedly used it to compromise infrastructure tied to the person behind that attack (SecurityWeek). SecurityWeek assesses exploitation as limited in scope, but the public PoC lowers the barrier for other actors, including defenders, rival criminals and researchers. An earlier RCE in XWorm V5.6 and earlier, exploitable with the C2 encryption key, was also publicly disclosed. The V6 line was marketed as 'RCE-fixed', and V6 changed the default key from <123456789> to <666666>.

Defender relevance: this is a vulnerability in attacker tooling, not in a victim product. The defensive value is for hunting, takedown and attribution work. Organizations running XWorm panels (including researcher-operated honeypots or sinkholes) should know the panel is itself exploitable. Defenders can use the known XWorm client behavior, such as Run key persistence, RegSvcs.exe injection, the plugin DLLs and AMSI bypass, for endpoint detection. The sources reviewed did not publish any panel hostnames, hashes or victim-side IOCs for the exploitation itself.

## MITRE ATT&CK

- T1587.004 Develop Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1566.001 Phishing: Spearphishing Attachment
- T1574.001 Hijack Execution Flow: DLL
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1218.009 System Binary Proxy Execution: Regsvcs/Regasm
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1056.001 Input Capture: Keylogging
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1185 Browser Session Hijacking

## Sources

- [SecurityWeek: In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit](https://www.securityweek.com/in-other-news-ics-sniper-attack-hacking-xworm-malware-operators-250k-chrome-exploit/)
- [SecurityWeek: XWorm RAT Evolves Into Surveillance Platform](https://www.securityweek.com/xworm-rat-evolves-into-surveillance-platform/)
- [mootoo11/xworm-7.4-RCE-PoC (GitHub PoC)](https://github.com/mootoo11/xworm-7.4-RCE-PoC)
- [Picus Security: XWorm Rises Again: Dissecting the Modular Malware's V6 Resurrection](https://www.picussecurity.com/resource/blog/xworm-rises-again-dissecting-the-modular-malwares-v6-resurrection)
- [Huntress Threat Library: XWorm Malware](https://www.huntress.com/threat-library/malware/xworm)
- [Trellix: XWorm V6: Exploring Pivotal Plugins](https://www.trellix.com/blogs/research/xworm-v6-exploring-pivotal-plugins/)
- [The Hacker News: XWorm 6.0 Returns with 35 Plugins](https://thehackernews.com/2025/10/xworm-60-returns-with-35-plugins-and.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3749