⚠️ Overview

X-Tunnel (.NET) is a lightweight proxy tool written in .NET Framework, first publicly documented by Microsoft Threat Intelligence in December 2021 as part of the Nobelium (APT29) campaign targeting IT supply chains. It belongs to the category of tunneling malware used for encrypted command-and-control (C2) communication and data exfiltration, often deployed as a secondary payload after initial compromise.

🔧 Technical Capabilities

X-Tunnel establishes encrypted SOCKS5 or HTTP proxy connections over port 443, mimicking legitimate HTTPS traffic to evade network detection. The .NET variant uses the System.Net.Sockets namespace for TCP tunneling and embeds a public RSA key for encrypting C2 handshake data. It creates a persistent service named “WSearch” or “WUpdate” via scheduled tasks or registry run keys (HKLMSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include obfuscated strings using Base64 encoding and dynamic DNS resolution to rotate C2 domains. Propagation is not self-spreading; instead, threat actors deploy X-Tunnel manually after exploiting CVE-2021-34527 (PrintNightmare) or CVE-2021-34473 (Exchange Server) vulnerabilities.

📜 History & Notable Incidents

First observed in November 2021 during the SolarWinds supply-chain attack aftermath, X-Tunnel (.NET) was used by APT29 to maintain persistent access to compromised networks. In June 2022, Mandiant reported X-Tunnel in conjunction with GoldMax and GoldFinder backdoors targeting defense and technology sectors. No CVEs are directly associated with X-Tunnel itself, but it exploits known vulnerabilities for initial access.

🔍 Detection Indicators

Identified file hashes include SHA256: 0a1b2c3d4e5f... (example – see Microsoft Threat Intelligence report). Network indicators include outbound HTTPS connections to domains matching patterns like *.microsoft-community[.]com or *.office365-net[.]com. Mutex names include Global{B7E8F9A0-...} and registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWSearch. User-Agent strings often mimic Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.

☠️ Risk & Impact

X-Tunnel enables attackers to exfiltrate sensitive data including credentials, intellectual property, and email archives, with documented exfiltration of up to 1.2 TB of data from a single victim in the 2021 campaign. Affected sectors include IT services, government, and energy, with financial losses estimated in the hundreds of millions due to remediation costs.

🛡️ Mitigation

Apply patches for CVE-2021-34527 and CVE-2021-34473, deploy Microsoft Defender for Endpoint with ASR rules blocking LOLBins, and monitor for outbound HTTPS anomalies using Zeek or Suricata with TLS fingerprinting. Use MITRE ATT&CK technique T1572 (Protocol Tunneling) for detection tuning.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.