Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies

First in a hunting series: an open directory holding a phishing site and XWorm RAT, whose spoofed login pages — blockchain and device-verification lures — steal credentials and seed phrases.

Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.

An obfuscated JavaScript downloader abusing paste.ee to stage payloads leads researchers to XWorm and AsyncRAT C2 infrastructure, with regex and SSL detection guidance for defenders.

Hunt.io analyzes a XenoRAT sample delivered as a ConfuserEx-protected Excel XLL titled 'Payment Details'—a shift from the RAT's gaming fare toward enterprise targets and financial lures.

Hunt.io spots RunningRAT—previously an access and data-theft tool linked to 2018 Olympics campaigns—now staging crypto-mining payloads via open directories and a separate staging VPS.

Hunt.io launches AttackCapture—a meta-sandbox indexing attacker burner instances: recon tools, exploits, malware and exfil artifacts, with MITRE ATT&CK tagging, code search and credential flagging.