Triple-Server XWorm Infection:
How Digital Forensics Identified the Attack Chain
* Three servers, one attacker, one entry vector — Linken Sphere 2. All data preserved for forensic review.
"Do You Specifically Install Viruses?"
On September 10, 2025 at 02:30, a customer submitted an urgent and highly accusatory ticket. All three servers purchased from the provider were infected. Passwords were stolen, and cryptocurrency wallet addresses were being automatically replaced when copied.
The customer was convinced this was an inside job:
The customer provided three server IPs.
CRITICAL CRYPTO THEFT PASSWORD LEAK
Malwarebytes Scan & PowerShell Forensics
Engineer Dylan began the investigation by running Malwarebytes scans on all three servers. The results confirmed widespread infection with backdoor.xworm.
Next, Dylan examined RDP login records — no obvious anomalies. Then, a deeper dive into PowerShell operational logs revealed the source:
- Executed
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational - Found an unusually high number of ScriptBlocks on September 3 between 07:19–07:20
- August 21 was system initialization — so September 3 was the infection date
- A suspicious PRO folder was created on September 3 at 07:19
XWorm Malware Deconstructed
Dylan performed a deep inspection of the suspicious file: C:\Users\Administrator\Downloads\PRO\Windows Powershell.exe
Key findings:
- No Zone.Identifier attribute → file was not downloaded directly from the internet
- It was executed via a PowerShell command (remote execution)
- VirusTotal analysis confirmed the malware family
The decoded configuration revealed the full scope of the threat:
{
"XWorm": {
"cncs": [["tcp://xxx.xxx.xxx.xxx"]],
"botnet_id": ["lauda"],
"extra_data": [{
"Hosts": ["xxx.xxx.xxx.xxx"],
"Ports": ["****"],
"KEY": "<123456789>",
"SPL": "<Xwormmm>",
"Sleep": 3,
"Group": "lauda",
"USBNM": "USB.exe",
"InstallDir": "%AppData%",
"InstallStr": "Powershell.exe",
"Mutex": "eOxxx...xxx",
"LoggerPath": "\\Log.tmp",
"BTC": "bcxxx...xxx",
"ETH": "0xxxx...xxx",
"TRC": "TTxxx...xxx"
}]
}
}
Threat summary:
- Malware family: XWorm — Remote Access Trojan (RAT) + Info Stealer
- C2 Server: xxx.xxx.xxx.xxx
- Botnet ID: lauda
- File disguised as: Powershell.exe
- Install directory: %AppData% (persistence)
- Mutex: eOxxx...xxx (prevents multiple instances)
- Clipboard hijacking: Replaces copied crypto wallet addresses with attacker's addresses
The Linken Sphere Connection
Analyzing the malware's Log.tmp file revealed a critical clue:
- Logs showed the use of Linken Sphere — a virtual/privacy browser
- Multiple [CTRL][ENTER] actions were recorded
- This suggested the attacker was testing or controlling the malware through a virtual browser environment to evade detection
Linken Sphere 2 was installed on all affected servers. Linken Sphere is an anti-detect browser commonly used for managing isolated browser profiles. Like many powerful automation tools, it can be abused when installed from untrusted sources or used with malicious content.
Our investigation identified suspicious activity related to this environment, which was the most likely source of the XWorm infection.
How the XWorm Infection Unfolded
Dylan reconstructed the complete attack chain:
Step 1 — Remote Access
The attacker gained remote control of the machine through Linken Sphere 2.
Step 2 — Payload Delivery
A PowerShell command was executed to download the XWorm malware locally.
Step 3 — Persistence
The malware installed itself in %AppData%, created a mutex to prevent multiple instances, and began logging activity to \Log.tmp.
Step 4 — Crypto Theft
XWorm started monitoring the clipboard. When crypto wallet addresses were copied, it silently replaced them with the attacker's addresses — BTC, ETH, and TRON.
CRITICAL The attacker used Linken Sphere's virtual environment to evade detection by local security software.
Customer Pushback & Final Explanation
The customer initially pushed back on the diagnosis:
Engineer Dylan responded with a firm but professional explanation:
Dylan listed possible entry vectors through Linken Sphere:
- Malicious content downloaded or attachments opened while browsing
- Visiting a phishing site or webshell-infected page
- The software source not being fully trusted and containing a backdoor
The customer was advised to check whether all three servers shared common activity — such as visiting the same high-risk websites or opening the same files.
INVESTIGATED EVIDENCE SHARED FORENSICS COMPLETE
Geek Tips — XWorm Detection & Forensics
How to detect XWorm on a Windows Server:
- Check PowerShell logs:
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-30) } - Look for suspicious mutexes: Use
Handle.exeorGet-Mutexto check for known XWorm mutexes - Monitor clipboard activity: XWorm replaces crypto wallet addresses — monitor clipboard changes
- Check %AppData% for hidden executables: Look for disguised
Powershell.exeorUSB.exe - Use VirusTotal: Submit suspicious files to check against known XWorm signatures
💡 This investigation uncovered the infection by combining Malwarebytes scanning + PowerShell event log analysis + VirusTotal lookup — a classic digital forensics trifecta.
Linken Sphere — A Double-Edged Sword
Linken Sphere is a privacy/virtual browser often used for legitimate purposes. However, it can also be weaponized:
- Attackers may abuse legitimate automation or privacy tools as part of a broader intrusion chain.
- It can be used to execute PowerShell commands remotely without detection
- It can serve as a persistent backdoor if the software source is compromised
🔍 If you use tools like Linken Sphere, always download from the official source, keep it updated, and restrict its network access.
Protecting Against Clipboard Hijacking
XWorm is one of many malware families that replace copied crypto addresses. Best practices:
- Always double-check the first and last 6 characters of any pasted wallet address
- Use a hardware wallet that displays the destination address on a physical screen
- Use clipboard-monitoring security tools that alert when a copied address is modified
- Keep antivirus with real-time protection enabled at all times
💰 In this case, the attacker's wallet addresses were: BTC (bcxxx...xxx), ETH (0x...xxx), TRC (TT...xxx) — all now flagged in threat intelligence feeds.
"We don't just tell you there's a virus.
We show you how it got in, where it came from,
and exactly what it did — so you can fix it for good."
Three servers. One entry vector. Full digital forensics — preserved for customer review.