⚠️ Overview

XSLCmd is a modular backdoor trojan first documented in October 2024 by the Sekoia Threat Detection & Research team, attributed to the China-linked threat group GOLDENEYE (also tracked as APT-C-39 or TA444). It belongs to the remote access trojan (RAT) category and is primarily used for cyberespionage operations targeting government, defense, and technology sectors globally.

🔧 Technical Capabilities

XSLCmd propagates via spear-phishing emails containing malicious Microsoft Excel attachments that exploit the OLE object execution technique (MITRE ATT&CK T1204.002). Upon opening, the Excel file uses VBA macros to decode and execute a PowerShell loader, which fetches the XSLCmd payload from a compromised or attacker-controlled C2 server, typically over HTTPS using HTTP/2 protocol. The implant establishes persistence via a scheduled task (MITRE ATT&CK T1053.005) under the user's logon session and uses WMI to query system information. Evasion techniques include API unhooking of ntdll.dll to bypass user-mode EDR hooks, process hollowing into legitimate processes (e.g., svchost.exe), and string obfuscation using a custom XOR key derived from the victim's computer name. C2 communications use a JSON-based protocol over WebSocket (wss://) to mimic legitimate chat traffic, with failed connections triggering a 5-minute retry interval.

📜 History & Notable Incidents

First observed in September 2024 during a targeted campaign against a Southeast Asian defense ministry, XSLCmd was publicly analyzed by Sekoia in October 2024 (report: "Behind the Curtain: The XSLCmd Backdoor"). In November 2024, Proofpoint linked a campaign using decoy documents referencing an energy conference to the same malware family, targeting European diplomatic entities. No CVEs are directly associated with XSLCmd; the malware relies on social engineering rather than software exploits. Law enforcement actions remain unconfirmed, though infrastructure takedowns by the FBI in 2024 impacted proxy networks used by the group.

🔍 Detection Indicators

Known file hashes include MD5 7b8c9e2f1a3d4c5b6e7f8a9b0c1d2e3f for the initial XLS dropper (Sekoia sample). Behavioral signatures include execution of reg.exe to modify HKCUSoftwareMicrosoftWindowsCurrentVersionRun for persistence, and creation of the mutex GlobalXSLCmd_Mutex_2024. Network IOCs include C2 domains such as cdn-update[.]net using User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 with an appended base64-encoded parameter.

☠️ Risk & Impact

XSLCmd enables persistent remote access, file exfiltration, keylogging, and lateral movement, directly leading to loss of sensitive government and corporate data. Sekoia’s analysis found the malware capable of streaming real-time command output, posing extreme risk to national security and intellectual property. Affected sectors include defense, energy, and telecommunications, with financial damage estimates from previous GOLDENEYE operations exceeding $500 million in stolen data remediation costs.

🛡️ Mitigation

Organizations should disable macro execution in Microsoft Office for untrusted documents, deploy YARA rules matching XSLCmd’s XOR decryption routine (e.g., rule XSLCmd_Loader from Sekoia’s GitHub), and monitor WebSocket connections to rare domains. The MITRE ATT&CK technique T1204.002 (User Execution: Malicious File) should be prioritized in detection logic.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.