BreakglassIntelligence
Back to reports
highPhishing

Multi-RAT C2 Operator: XWorm, Hook, DCRat, AsyncRAT, njRAT — Breakglass Intelligence Report

PublishedMarch 13, 2026
Threat Actors:ProfileAssessment
phishingasyncratxwormcredential-theftc2apt

TLP: AMBER Date: 2026-03-09 Analyst: GHOST (Breakglass Intelligence) Classification: Cybercrime Investigation ID: xworm-march9-v2

Executive Summary

A deep infrastructure investigation of Oracle Cloud VPS 143.47.53.106 reveals a prolific multi-RAT operator running at least 6 different malware families (XWorm, Hook, DCRat, AsyncRAT, njRAT/Bladabindi) from a single server since June 2024. The operator uses LocaltoNet and other tunneling services to rotate C2 domains, with 40+ hostnames observed in passive DNS over 21 months.

The most critical finding is an open MinIO S3 bucket on port 9679 containing 210 MB of stolen victim data from the Hook banking trojan campaign — including camera photos, audio recordings, screenshots, and DCIM files from 8 real victim devices. The filenames contain Eastern Arabic numerals, indicating Middle Eastern victims. The campaign remains ACTIVE with the most recent exfiltration occurring 2 days ago (2026-03-07).

The server also hosts a MikroWisp v6.66 ISP management panel for "NEXO58, C.A." — a Venezuelan ISP located in Caracas — with an exposed phpMyAdmin 5.0.2 installation. The operator uses a phishing domain auth.androidfilehost.org (fake Android File Host) for Hook panel/exfiltration infrastructure, registered via NameCheap with actual DNS pointing to a Ukrainian VPS (Virtual Systems LLC).

Key Statistics

  • 6 RAT families deployed from single IP
  • 40+ domains/subdomains rotated as C2 channels
  • 8 confirmed victim devices (Hook banking trojan)
  • 210 MB stolen data in open MinIO bucket
  • 21 months of continuous operation (Jun 2024 — present)
  • 21 open ports on primary C2 server
  • 3 countries of infrastructure (Ireland, Italy, Ukraine)

Key Findings

  • OPEN MinIO exfiltration bucket at https://143.47.53.106:9679/hook/ — unauthenticated S3 listing of 67 stolen files from 8 victim devices
  • 8 real Hook victims identified by device ID (HW-prefixed), with stolen camera photos, audio, screenshots, DCIM files
  • Arabic locale victims — filenames with Eastern Arabic numerals on 2 devices, Samsung "One UI Home" screenshots
  • Operator test device: bot_test_samsung_s23 with 70-byte placeholder photos (Jan 15, 2026)
  • Malware staging: 2 APK payloads in s2/ directory (com.xxx.zzz.apk, vcxvxc.apk) — Hook trojan builds
  • Phishing domain: auth.androidfilehost.org impersonating Android File Host, cert active since Apr 2025
  • Venezuelan ISP panel: MikroWisp v6.66 for NEXO58, C.A. on port 8458 with exposed phpMyAdmin
  • Internal IP leak: 10.10.10.252 visible in MikroWisp JavaScript console log
  • SOCKS5 proxy on port 3388 (requires authentication)
  • Storj storage node on port 30003 (legitimate distributed storage)
  • 6 malware families: XWorm, Hook, DCRat, AsyncRAT, njRAT, Bladabindi
  • Campaign duration: At least June 2024 through present (21 months)
  • Related Italian C2: 80.211.137.34 (Aruba S.p.A., Italy) hosting reginatower.com, axsante.org, shumukh.etpcon.net

What Was Found vs. What Was Known

AspectPrior Reporting (v1)Our Findings (v2)
Infrastructure1 IP, 3 ports2 IPs, 21+ ports, 40+ domains
RAT families3 (XWorm, DCRat, Hook)6 (+ AsyncRAT, njRAT, Bladabindi)
VictimsUnknown8 confirmed devices, Arabic locale
Stolen dataUnknown210 MB in open MinIO bucket
Campaign durationJan-Mar 2026Jun 2024 — present (21 months)
AttributionLow-sophisticationMid-sophistication with ISP access
PhishingUnknownauth.androidfilehost.org
Panel accessNot attemptedOpen MinIO bucket, ISP panel found
Related infraNone80.211.137.34 (Italy), 45.12.2.233 (Ukraine)

Attack Chain

Delivery (Phishing/Fake Tools)
    |
    v
Token GrabberV2.exe / fake APKs (auth.androidfilehost.org)
    |
    v
Go Dropper -> PowerShell -> Hidden XWorm/.NET RAT deployment
    |
    v
Hook APK -> Android device compromise -> Camera/Audio/File exfiltration
    |
    v
C2: mzsgu2rhxn.localto.net:3480 (XWorm)
C2: 143.47.53.106:8090 (DCRat)
C2: 143.47.53.106:9679/hook/ (Hook exfil bucket)
    |
    v
Stolen data -> MinIO S3 bucket (open, unauthenticated)

Infrastructure Analysis

Port Inventory — 143.47.53.106

PortServicePurpose
22OpenSSH 8.0Remote administration
80Kestrel (.NET)LocaltoNet reverse proxy
111rpcbindNFS/RPC
3388SOCKS5Proxy (auth required)
3480XWorm C2RAT command and control
8090DCRat C2RAT command and control
8458Apache/2.4.65MikroWisp ISP panel + phpMyAdmin 5.0.2
9679nginx + MinIOHook exfiltration storage
30003Storj DRPCDistributed storage node
1951,3689,4949,6602,7071,8060,8457,9606UnknownAdditional C2/tunnel endpoints
2003,2082,8080,8087,8473,8880DynamicTunnel ports (intermittent)

Network Infrastructure

IPProviderLocationRole
143.47.53.106Oracle Cloud (AS31898)IrelandPrimary multi-RAT C2
158.178.201.63Oracle Cloud (AS31898)Austin TXLocaltoNet server (not attacker)
80.211.137.34Aruba S.p.A.ItalyRelated C2 (Express.js/Node.js)
45.12.2.233Virtual Systems LLC (VSYS)UkraineHook phishing DNS target

Domain Timeline (143.47.53.106 Passive DNS)

DateDomainPurpose
2024-06particularsantander.shopSpanish banking phishing
2024-07LocaltoNet tunnels beginC2 rotation
2024-08dash.samakaal.soSomali infrastructure
2025-02hashmy.etpcon.netetpcon.net infrastructure
2025-04auth.androidfilehost.orgHook phishing domain registered
2025-07padriadaavenida.com/netVenezuelan bait domains
2025-08splunk.e-soluciona.onlineFake Splunk login
2025-10apache-sys.localto.netFake Apache system
2025-11chancellerierdc.comDRC embassy impersonation
2025-12axsante.org, shumukh.etpcon.netHealth sector, Arabic infra
2026-01cedicapital.tdeeplusghonline.comFinancial phishing
2026-01-30143.47.53.106:8090 DCRat (ThreatFox)
2026-02supermercadoverde.com/netVenezuelan bait
2026-02-05143.47.53.106:9679 Hook (ThreatFox)
2026-03-04luuchinzi.com (created 5 days ago)Active C2 tunnel
2026-03-099zolmh2qkt/cou369ppsh.localto.netACTIVE TODAY

Certificate Analysis — auth.androidfilehost.org

PeriodIssuerStatus
Apr 2025 - Jul 2025Let's Encrypt R10Expired
Jul 2025 - Oct 2025Let's Encrypt R11 (wildcard)Expired
Oct 2025 - Jan 2026Let's Encrypt E7 (on 143.47.53.106:9679)Expired
Dec 2025 - Mar 2026Let's Encrypt E8 (on 45.12.2.233)ACTIVE

Hook Banking Trojan — Open MinIO Exfiltration Bucket

Bucket Details

PropertyValue
URLhttps://143.47.53.106:9679/hook/
BackendMinIO (S3-compatible object storage)
Bucket Namehook
Owner ID02d6176db174dc93cb1b899f7c6078f08654445fe8cf1b6ce98d8855f66bdbf4
Owner Displayminio
AuthenticationNONE — fully open listing
Total Files67
Total Size210.4 MB
Victim Devices8 real + 1 test + 1 staging
Injects Bucket/injects/ (HTTP 403 — exists but locked)

Victim Device Inventory

Device IDFilesSizeData TypesLast Active
HW-dbfe8363b7c5ae601223 MBCamera, Audio, Files (ARABIC)2026-03-07
HW-e25395a7c09f4de71025 MBCamera, Files (ARABIC)2026-03-01
HW-272bb59cd3a308df4115 MBAPKs (Telegram, Call Recorder)2026-01-31
HW-0a9664b910cf281241.4 MBCamera, DCIM2026-02-17
HW-12ccbdbf2eba2f3711.7 MBDCIM2026-02-17
HW-9b443c05e5b0d9031011 MBDCIM, Screenshots (Samsung)2025-11-02
HW-dff9d515eb601d2a42.8 MBAudio, DCIM, Photos2025-08-20
HW-898eeed5aba5ca3a1162 KBPhotos2025-06-17
bot_test_samsung_s23167 KBCamera stubs, .dat files2026-01-15
s2436 MBAPK builds + icons2025-08-19

Arabic Locale Artifacts: Devices HW-dbfe8363b7c5ae60 and HW-e25395a7c09f4de7 contain filenames with Eastern Arabic numerals (U+0660-U+0669). Screenshots reference Samsung "One UI Home". These victims use Arabic-locale Samsung Galaxy devices, consistent with Middle Eastern geography.

Malware Samples

From v1 Investigation

SHA256FamilyTypeSize
109b2330...XWormGo dropper (PE64)3.4 MB
84fae604...XWorm/njRAT.NET hybrid (PE32)111 KB

From OTX (Additional samples communicating with 143.47.53.106)

SHA256FamilyDetectionDate
90b9a533...njRATClamAV: Win.Packed.njRAT2026-03-07
5fb2d73e...AsyncRATDefender: Backdoor:MSIL/AsyncRAT.GG!MTB2025-12-01
927af7c3...AsyncRATDefender: Backdoor:MSIL/AsyncRAT.GG!MTB2025-12-01
4f7c31b6...AsyncRATDefender: Backdoor:MSIL/AsyncRAT.GG!MTB2025-12-01
69bc9be2...Bladabindi/njRATDefender: Backdoor:MSIL/Bladabindi2025-11-17

Threat Actor Profile

Attribution Assessment

  • Confidence: MEDIUM
  • Country/Region: Latin America (Venezuela) with Middle Eastern victim targeting
  • Motivation: Financial (banking trojan + credential theft)
  • Sophistication: MID — commodity RATs with multi-family diversification, tunneling OpSec, ISP access
  • Active since: At least June 2024
  • Currently active: YES (exfiltration 2 days ago, new domains today)

OPSEC Failures

  1. Open MinIO bucket — 210 MB of victim data publicly accessible
  2. Internal IP leak — 10.10.10.252 in MikroWisp JavaScript console.log
  3. Expired TLS cert — auth.androidfilehost.org on 143.47.53.106 (Jan 28, 2026)
  4. phpMyAdmin exposed — v5.0.2 accessible without IP restriction
  5. Test device naming — bot_test_samsung_s23 reveals operator device model
  6. Same IP for everything — ISP panel, RAT C2s, exfil storage all on one server

Operator Timeline

DateActivity
2024-06First domains on 143.47.53.106
2024-07LocaltoNet tunnel usage begins
2024-08Somali infrastructure (dash.samakaal.so)
2025-02etpcon.net subdomains
2025-04auth.androidfilehost.org registered, Hook staging
2025-06First Hook victim data
2025-07Venezuelan domains, chgip.online tunnels
2025-08Fake Splunk login
2025-10Italian Aruba server 80.211.137.34
2025-11DRC embassy impersonation, njRAT/Bladabindi
2025-12AsyncRAT samples, health sector targeting
2026-01Hook test device, DCRat on port 8090
2026-02Hook on port 9679, MikroWisp ISP panel
2026-03XWorm on port 3480, new domains, ACTIVE exfiltration

MITRE ATT&CK Mapping

TacticTechniqueID
Initial AccessPhishingT1566
ExecutionPowerShellT1059.001
PersistenceRegistry Run KeysT1547.001
Defense EvasionObfuscated FilesT1027
Defense EvasionDisable DefensesT1562.001
Credential AccessInput CaptureT1056.001
CollectionScreen CaptureT1113
CollectionAudio CaptureT1123
CollectionVideo CaptureT1125
CollectionData from Local SystemT1005
C2Application Layer ProtocolT1071
C2ProxyT1090
C2Dynamic ResolutionT1568
ExfiltrationExfiltration Over C2T1041

IOC Summary

Network Indicators (defanged)

  • 143[.]47[.]53[.]106 — Primary multi-RAT C2
  • 80[.]211[.]137[.]34 — Related C2 (Italy)
  • 45[.]12[.]2[.]233 — Hook phishing DNS
  • mzsgu2rhxn[.]localto[.]net:3480 — XWorm C2
  • auth[.]androidfilehost[.]org — Hook phishing/exfil
  • androidfilehost[.]org — Phishing parent domain
  • luuchinzi[.]com — Active C2 (created 2026-03-04)
  • supermercadoverde[.]com / .net — Active bait domains
  • cedicapital[.]tdeeplusghonline[.]com — Financial phishing
  • chancellerierdc[.]com — DRC embassy impersonation

File Indicators (SHA256)

  • 109b233024348f26571c086aa6aae6eeedb062a704b4a23e0d87dd2234659103 — Go XWorm dropper
  • 84fae604e319f9bede31f822019f1b35a9a893c0873b195d85b0a9c486f40e9a — .NET XWorm/njRAT
  • 90b9a5337ed836afef5f432407dbc0c7675d11d54f3fe78af99cbae4c924b8bd — njRAT
  • 5fb2d73efa82738be1c6076242fd9097d8f277fe5d9185a45e356e76b8a9d38c — AsyncRAT
  • 927af7c313eb63cf0a6c7ef95c3231689584fd886dee151f549167d3c22ef2a4 — AsyncRAT
  • 4f7c31b6723288e8041daaaa3a63ab1fa013f0474ce0cd89e9d2a333bb50f6cd — AsyncRAT
  • 69bc9be2019663cc075ad613ccc13151ab03414261a19de8264d05cead84fbe7 — Bladabindi/njRAT

Host Indicators

  • Filename: Token GrabberV2.exe, CrackedLoader.exe
  • Drop path: %TEMP%\CrackedLoader.exe
  • Startup LNK: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\CrackedLoader.lnk
  • GUID: 469ff7a0-5aea-4dde-b17b-4b772472a42b
  • Internal IP: 10.10.10.252
  • MinIO Owner: 02d6176db174dc93cb1b899f7c6078f08654445fe8cf1b6ce98d8855f66bdbf4

Immediate (24-48 hours)

  1. Block 143.47.53.106, 80.211.137.34, 45.12.2.233 at network perimeter
  2. Block *.localto.net, *.chgip.online, *.torao.online, *.local2net.com at DNS
  3. Block auth.androidfilehost.org and androidfilehost.org at DNS
  4. Deploy YARA rules from xworm_march9_v2.yar
  5. Report to Oracle Cloud abuse: abuse@oracleemaildelivery.com

Short-term (1-2 weeks)

  1. Submit all IOCs to ThreatFox, MalwareBazaar
  2. Report phishing domain to NameCheap (androidfilehost.org)
  3. Report C2 domain to Spaceship (luuchinzi.com)
  4. Coordinate with Middle Eastern CERTs for Hook victim notification

Medium-term (1-3 months)

  1. Monitor new LocaltoNet subdomains on Oracle Cloud ranges
  2. Track Hook APK distribution channels
  3. Build passive DNS monitoring for identified tunnel services
  4. Investigate NEXO58, C.A. relationship — is this ISP compromised or complicit?

GHOST — Breakglass Intelligence "One indicator. Total infrastructure."

Share