Ukraine Warns of Weaponized XLL Files Delivering CABINETRAT Malware via Zip Archives

CERT-UA has issued an urgent warning that a new malware campaign is weaponising Excel add-in (XLL) files to deploy the CABINETRAT backdoor, with activity observed throughout September 2025.

The XLLs masquerade as benign documents such as “Звернення УБД.xll” and “recept_ruslana_nekitenko.xll,” exploiting Excel’s Add-in Manager and the xlAutoOpen export to gain execution, and a ZIP archive named “500[.]zip” was used to deliver a malicious add-in named “dodatok[.]xll.” Once loaded, the campaign drops multiple payloads, including a runner.exe in the user’s AppData and

Startup folders, a loader XLL in Excel XLSTART, and an Office[.]png image containing the CABINETRAT shellcode, with persistence via a random registry key and an hourly scheduled task. CERT-UA notes that CABINETRAT provides information gathering, command execution, file operations, screenshots, and TCP communication, including a port-knocking-like sequence across ports 18700, 42831, 20046, and 33976.

IOCs include dozens of SHA-256 hashes for XLL, EXE, PNG, and ZIP files, plus specific file paths and IPs 20.112.250[.]113 and 20.70.246[.]20 on ports 443 and 433; attribution of this campaign is described as claims, including the assignment of the identifier UAC-0245 by the UAC group. Organizations are urged to block Excel add-in loading, inspect suspicious ZIPs, and update endpoint security to detect CABINETRAT signatures.