Russian Hackers Target Ukraine with XWorm RAT Malware

Researchers at Cyble Research and Intelligence Labs (CRIL) have discovered that the Russia-linked UAC-0184 group is targeting Ukraine with the XWorm remote access trojan (RAT) through the use of Python -related files .

See also: Boolk hackers distribute new BMANAGER malware

The campaign begins with a malicious LNK shortcut file, disguised as a legitimate Excel document , which executes a PowerShell script. The script downloads two files, “ pkg.zip ” and “ NewCopy.xlsx ”, from a specified URL. The LNK shortcut file then executes “ pythonw.exe ” using the start command , which copies files and saves them to a new folder. “pythonw.exe” loads a malicious DLL , “ python310.dll ”, via DLL sideloading, injecting shellcode into the MSBuild process .

The hackers use a technique called DLL sideloading, where a malicious library file is disguised as a legitimate one. This allows the attackers to execute their code under the guise of trusted software. They also use a tool called Shadowloader to inject the XWorm RAT into a running process, further concealing its presence.

The XWorm RAT is then executed, offering a range of capabilities, including data theft, DDoS , and cryptocurrency address manipulation. The malware attempts to connect to a Command-and-Control (C&C), but at the time of analysis, the server was down, resulting in no malicious activity being observed.

See also: Chinese hackers distribute SpiceRAT and SugarGh0st malware

While the initial infection vector remains unclear, researchers suspect that phishing emails may play a role. CRIL researchers had previously observed the UAC-0184 group using lures tailored to Ukrainian targets, often mimicking official government or public service communications.

Protection from XWorm RAT

The XWorm RAT malware used in the campaign is designed to be easily accessible even to malicious actors lacking sophistication and technical expertise. The versatile malware offers multiple functionalities, including data theft, DDoS attacks, manipulation of cryptocurrency addresses, ransomware , and downloading additional malware to compromised systems. Cyble researchers have suggested several measures to defend against this campaign:

• Implement strong email filtering to block malicious attachments.
• Be careful with email attachments, especially from unknown senders.
• Limit the execution of scripting languages ​​where possible.
• Use the whitelist to control which programs can run.
• Deploy strong antivirus and malware protection solutions.
• Enforce strong, unique passwords and two-factor authentication.
• Monitoring networks for unusual activity or data intrusion attempts.

See also: Evasive SquidLoader Malware Targets Chinese Organizations

A Remote Access Trojan (RAT), such as the XWorm RAT, is a type of malware that allows a hacker to take control of a computer or network remotely. Once installed, a RAT can operate stealthily, allowing the attacker to access sensitive information, install additional malware, or manipulate system settings. Common distribution methods include phishing emails, malicious websites, and infected software downloads. The insidious nature of RATs makes them a significant cybersecurity threat , as they often go undetected by standard security measures. Regular software updates, strong antivirus programs , and careful online behavior are essential to protecting against RAT infections.

Source: thecyberexpress