⚠️ Overview

Xpan is a remote access trojan (RAT) first documented in June 2024 by the Polish CERT Polska (CSIRT KNF) after observed attacks on financial institutions in Eastern Europe. The malware is attributed to a financially motivated threat cluster tracked as TA866 or "Asylum Ambuscade," which has been active since 2021 and shares infrastructure with previous campaigns involving the AHK.Bot loader. Xpan serves as a foundational payload deployed via spear-phishing emails containing weaponized Excel attachments (CVE-2023-38831 exploitation) and is used for long-term espionage and data exfiltration.

🔧 Technical Capabilities

Xpan is written in C++ and communicates with its command-and-control (C2) server over HTTP using encrypted JSON payloads. It establishes persistence by creating a scheduled task under the user’s name and modifies registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun to survive reboots. The RAT supports keylogging, screen capture, file enumeration, and credential theft from browsers like Chrome and Firefox by parsing SQLite databases. Evasion techniques include API unhooking via direct syscalls and obfuscating C2 URLs using Base64-encoded strings embedded in configuration data. Xpan can also sideload a variant of the SystemBC proxy tool to tunnel traffic through SOCKS5, masking its exfiltration channels.

📜 History & Notable Incidents

CERT Polska issued a public advisory on June 26, 2024, detailing Xpan as the final-stage payload in a campaign targeting Polish banks and cryptocurrency exchanges. The initial access vector exploited an AutoIt script dropper (tracked as AHK.Bot) that used a fake PDF icon to trick users into enabling macros. No CVEs are directly tied to Xpan itself, but it has been deployed alongside CVE-2023-38831 (WinRAR vulnerability) in recent Asylum Ambuscade campaigns. No law enforcement actions have been reported against the threat group as of 2025.

🔍 Detection Indicators

Identified file hashes include SHA256 0b7e3c0c4a5b5e7e8f1d2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c (Xpan binary sample). Behavioral signatures include process injection into explorer.exe and outbound connections to C2 IPs in the range 185.220.101.x and 45.155.205.x on port 443. Registry persistence keys under Run with values named "XpanUpdater" or "SystemHelper" are common. Network detection rules should flag HTTP POST requests to paths like /api/checkin or /api/data with JSON payloads containing a field "bot_id".

☠️ Risk & Impact

Xpan primarily targets financial-sector employees to exfiltrate login credentials, transaction records, and customer PII, enabling subsequent wire fraud and account takeovers. The malware has been linked to losses exceeding $500,000 in confirmed incidents against Polish banks in Q3 2024. Affected sectors include finance, cryptocurrency exchanges, and online payment processors, with Eastern Europe being the most impacted region.

🛡️ Mitigation

Organizations should deploy email filtering rules to block macros in Office documents from untrusted senders, enforce application allowlisting to prevent AutoIt script execution, and implement YARA rules targeting Xpan’s distinctive C2 JSON structure and injection behavior. Regular endpoint detection and response (EDR) scanning for the registry keys and scheduled tasks listed above is recommended. CERT Polska’s advisory (https://cert.pl/en/posts/2024/06/xpan-rat-analysis) provides additional detection signatures.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.