FortiGuard Labs observed a multi-stage phishing campaign distributing the XWorm remote access trojan through malicious Excel attachments. The document abuses CVE-2018-0802 in Microsoft Equation Editor to retrieve an HTA file, which then triggers a fileless .NET loader that uses process hollowing to inject XWorm into a newly spawned Msbuild.exe process. The RAT communicates with its C2 using AES-encrypted traffic and exposes a broad command set with plugin support for extended control. The campaign showcases sophisticated use of living-off-the-land binaries and fileless techniques to achieve persistent remote control across compromised endpoints.
Analysts reconstructed the flow from the phishing email to the Excel OLE exploit, HTA execution, PowerShell-based .NET module download, and final process hollowing into Msbuild.exe. Static and dynamic review highlighted Base64-encoded payload data concealed within a JPEG image, with the final XWorm component loaded into memory without writing a decrypted executable to disk during execution. Network captures showed AES-encrypted packets sent to the C2 domain berlin101.com over port 6000. The report also catalogued the extensive command set and plugin architecture of XWorm.
FortiGuard recommends enabling macro and OLE protections, applying the patch for CVE-2018-0802, and restricting execution of Msbuild, PowerShell, and HTA files originating from email content. Deploy web filtering, anti-phishing controls, and IDS/IPS signatures tied to the observed indicators to block delivery and staging at the gateway. Monitor for anomalous process trees—especially Msbuild.exe launched from PowerShell—to surface exploitation early.
Upon detection, isolate the affected endpoint, terminate malicious processes, and evict the loaded XWorm module from memory. Collect forensic artifacts including command-line telemetry, network logs, and registry changes to scope the intrusion. Reset potentially compromised credentials, update the vulnerable Equation Editor component, and block the malicious domains and the C2 server. Apply threat-intel updates to EDR/SIEM detections to prevent recurrence and hunt for related activity across the environment.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands:
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
