XTunnel — Malware Profile

XTunnel a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by APT28 during the compromise of the Democratic National Committee.

MITRE ATT&CK techniques (8)

• T1008 Fallback Channels
• T1027 Obfuscated Files or Information
• T1027.016 Junk Code Insertion
• T1046 Network Service Discovery
• T1059.003 Windows Command Shell
• T1090 Proxy
• T1552.001 Credentials In Files
• T1573.002 Asymmetric Cryptography

IntelFusions coverage

• Russia's APT28 hackers move to disposable malware and AI-driven tools 2026-06-11

Attributed threat actors

• APT28

Read the full analysis on IntelFusions