XWorm RAT Operators Compromised via Unauthenticated C2 Panel Flaw
An independent researcher published proof-of-concept code for an unauthenticated remote code execution flaw in the XWorm remote access tool's command-and-control panel.
Key points
- Researcher Mootoo disclosed an unauthenticated RCE vulnerability in XWorm RAT C2 panels up to version 7.4.
- The flaw allows attackers to overwrite DLL files via path traversal and execute code on the operator's server.
- Mootoo used the exploit to compromise infrastructure linked to the individual who attempted to infect them.
Independent security researcher Mootoo has published proof-of-concept exploit code for a critical unauthenticated remote code execution vulnerability found in the command-and-control panel of the XWorm remote access tool. The flaw affects panel versions up to 7.4 and allows an attacker to take over the infrastructure used by the malware operator without requiring any interaction from the legitimate user.
According to SecurityWeek, Mootoo discovered the vulnerability on October 4 while reverse-engineering a sample of XWorm malware that had been used in an attempt to compromise their own systems. The researcher successfully leveraged the flaw to gain unauthorized access to the command-and-control infrastructure tied to the person behind that specific attack attempt.
Technical Details of the Exploit
The vulnerability exists because the XWorm C2 panel fails to properly authenticate incoming connections that mimic infected client machines. An attacker who possesses the panel’s IP address, port number, and communication key can spoof a legitimate infected device. These credentials can be extracted directly from the configuration files of an XWorm client binary.
Once the attacker poses as an infected machine, they can exploit a path traversal issue to overwrite dynamic link libraries on the server. This action results in remote code execution on the command-and-control host. The process requires no further action from the malware operator, making it a silent and highly effective takeover method.
Scope and Current Status
Mootoo told SecurityWeek that the vulnerability appears to be exploited on a limited scale in the wild. However, the publication of the proof-of-concept code means that other threat actors can now easily replicate the attack against any XWorm operator using vulnerable panel versions. The researcher emphasized that the flaw allows for complete server compromise.
No patch or fix has been confirmed yet by the developers of the XWorm panel. Users relying on this version of the command-and-control interface remain exposed to takeover attempts by anyone who can obtain the necessary connection details from a compromised client system.
What should you do?
Organizations should audit their environments for any presence of XWorm malware to prevent their systems from leaking C2 credentials. Security teams should monitor network traffic for unusual connections to known command-and-control ports that may indicate an attempt to spoof client traffic. Administrators should review server access logs for signs of unauthorized DLL modifications or unexpected code execution on management servers. Once the vendor provides an update, administrators should apply it immediately to mitigate the remote code execution risk.
What to do and how to stay safe: XWorm
- Scan internal networks for indicators of compromise related to XWorm RAT to ensure no client configurations are exposing C2 server details.
- Monitor firewall logs for inbound connections to command-and-control ports that originate from unexpected sources or mimic client signatures.
- Implement strict file integrity monitoring on servers hosting management panels to detect unauthorized modifications to system libraries.
- Isolate suspected command-and-control infrastructure from the public internet until a verified security update is available and deployed.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the XWorm C2 panel are affected by this vulnerability?
The vulnerability affects XWorm RAT command-and-control panel versions up to and including 7.4.
How did the researcher discover this specific flaw?
Mootoo found the flaw on October 4 while reverse-engineering an XWorm sample used in an attack against them.
Is there a patch available for this remote code execution flaw?
No fix has been confirmed yet; the researcher has only published proof-of-concept exploit code.
