# VOID#GEIST Malware: Multi-Stage Delivery of AsyncRAT and XWorm

> Securonix identifies VOID#GEIST, a stealthy multi-stage malware campaign using obfuscated batch scripts to deliver XWorm, AsyncRAT, and Xeno RAT payloads.

- Published: 2026-03-06T16:17:52.000Z
- Severity: medium
- Category: Malware
- Tags: VOID GEIST, AsyncRAT, XWorm, Xeno RAT, Remote Access Trojan, Securonix
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/03/multi-stage-voidgeist-malware.html
- Canonical: https://runtimerebel.com/blog/void-geist-malware-multi-stage-delivery-of-asyncrat-and-xworm

## Key points

- VOID#GEIST delivers encrypted remote access trojans like XWorm and AsyncRAT, granting attackers full control over compromised Windows environments.
- Windows systems are targeted via highly obfuscated batch scripts that execute multi-stage deployment processes to bypass security detections.
- Defenders must implement script block logging and monitor for unusual CMD or PowerShell execution patterns originating from temporary directories.

A recent analysis by Securonix Threat Research has uncovered a sophisticated and stealthy malware campaign codenamed VOID#GEIST. According to [The Hacker News](https://thehackernews.com/2026/03/multi-stage-voidgeist-malware.html), this campaign utilizes a multi-stage attack [TTP](/glossary#ttp) to deliver various high-impact Remote Access Trojans (RATs), including XWorm, AsyncRAT, and Xeno RAT. The campaign is notable for its reliance on heavily obfuscated batch scripts to orchestrate the infection chain, making it difficult for traditional [EDR](/glossary#edr) solutions to detect the initial intrusion through static analysis alone.

## VOID#GEIST Batch Script Obfuscation Analysis

The attack begins with the execution of a primary batch script, likely delivered through [Phishing](/glossary#phishing) or other initial access methods. This script is far from a standard administrative tool; it employs complex obfuscation techniques designed to frustrate analysts and automated sandboxes. By using environment variable expansion and character replacement, the script constructs its commands at runtime, effectively hiding its true intent from scanners looking for common malicious strings.

During the technical analysis, researchers noted that the script functions as a downloader and orchestrator. It reaches out to a remote server to fetch the next stage of the infection, which often involves an encrypted payload. This method of staging ensures that the final malware—whether it be XWorm or AsyncRAT—is never stored on disk in a decrypted state until the final execution phase. Such tactics are characteristic of modern [APT](/glossary#apt) activity, although direct attribution for VOID#GEIST remains unconfirmed in the current reporting.

### Payload Analysis: XWorm, AsyncRAT, and Xeno RAT

The ultimate goal of the VOID#GEIST campaign is to establish a persistent [C2](/glossary#c2) channel via one of three prominent RATs:

*   **XWorm:** A modular trojan capable of keylogging, file manipulation, and even [Ransomware](/glossary#ransomware) functions. Its versatility makes it a favorite for attackers seeking broad control over a victim's environment.
*   **AsyncRAT:** An open-source RAT that provides extensive remote control capabilities. It is frequently used for [Lateral Movement](/glossary#lateral-movement) once an initial foothold is established.
*   **Xeno RAT:** A newer, C#-based RAT that offers a highly modular architecture, allowing attackers to load specific plugins for tasks like credential theft or microphone monitoring.

While no specific [CVE](/glossary#cve) is currently leveraged for the delivery of these payloads, the campaign exploits the inherent trust in built-in Windows command-line interpreters. By avoiding direct [RCE](/glossary#rce) through software vulnerabilities and instead relying on script-based execution, the threat actors increase their chances of staying under the radar of a [SOC](/glossary#soc).

### Strategic Recommendations for Defense

To effectively combat this threat, security teams should focus on detecting the underlying behaviors of the script rather than searching for a specific [IoC](/glossary#ioc) that may change between targets. Organizations should prioritize detecting XWorm and AsyncRAT payloads by monitoring for abnormal child processes spawned by `cmd.exe` or `powershell.exe`, particularly when they originate from the `%TEMP%` or `%PUBLIC%` directories.

Furthermore, understanding **how to detect VOID#GEIST malware execution** requires the implementation of advanced logging. Defenders should enable PowerShell Script Block Logging and Command Line Process Auditing to capture the de-obfuscated commands as they execute in memory. Integrating these logs into a [SIEM](/glossary#siem) can provide the visibility needed to identify the multi-stage execution flow described in the [MITRE ATT&CK](/glossary#mitre-att-ck) framework, specifically focusing on T1059.003 (Windows Command Shell).

**Related:** [XWorm RAT Delivery: Analyzing Multi-Stage Infection Chains](/blog/xworm-rat-delivery-analyzing-multi-stage-infection-chains)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/void-geist-malware-multi-stage-delivery-of-asyncrat-and-xworm