Loading malware…
EarthWorm is an open-source network tunneling utility used to create covert proxy channels and reverse tunnels between compromised systems and attacker-controlled infrastructure. It is widely described as a more capable successor to HTran/lcx, extending those concepts with SOCKS5 proxying, reverse SOCKS5 proxying, and port-forwarding functionality. Implementations have been reported in C and support multiple architectures and operating systems, including Windows and Linux, with additional reporting indicating support for macOS and some ARM/MIPS environments.
In intrusion operations, EarthWorm is typically deployed after initial compromise to provide outbound command-and-control connectivity, internal pivoting, and access to otherwise unreachable network segments. Its role is generally post-exploitation rather than initial access: operators use it to expose internal services, relay traffic through a foothold, and support lateral movement or interactive follow-on activity. Reporting repeatedly associates EarthWorm with stealthy espionage tradecraft on perimeter devices, Exchange servers, IIS servers, and enterprise Windows environments.
EarthWorm has been observed in campaigns involving exploitation of public-facing systems and edge infrastructure, including Microsoft Exchange compromise during ProxyLogon-era activity, PAN-OS firewall intrusions associated with CVE-2026-0300, and Sitecore exploitation tied to CVE-2025-53690. It has also appeared in broader post-compromise toolsets used against government, critical infrastructure, nonprofit, and enterprise targets. Threat actors and clusters publicly linked to EarthWorm usage include Volt Typhoon, BackdoorDiplomacy, UAT-8837, CL-STA-0046, and activity attributed or assessed as China-linked in multiple cases. Its repeated use alongside other tunneling and proxy tools such as FRP, ReverseSocks5, reGeorg, iox, and HTran underscores its utility as commodity but operationally effective infrastructure for covert access.
EarthWorm is best characterized as a tunneling/proxy backdoor utility rather than a traditional standalone implant focused on persistence or payload delivery. High-confidence reporting supports its use for SOCKS-based tunneling, proxying, and traffic relay in support of command and control, persistence of access, and lateral movement.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Some of the tools we saw used in post-compromise activity in those impacted since March 2 include: ... EarthWorm tunnel tool
The Earthworm tool came as a more powerful replacement to the ageing lcx/Htran one. It incorporated lcx's core concepts ... and added SOCKS5 proxy and reverse SOCKS5 proxy functionalities.
Some of the tools we saw used in post-compromise activity in those impacted since March 2 include: ... EarthWorm tunnel tool
CVE-2025-53690 is a ViewState deserialization vulnerability that affects any version of Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud deployed in the manner above. Successful exploitation of the vulnerability might lead to remote code execution and non-authorised access to information. | EARTHWORM (lfe.ico, ufp.exe, ufp.ico)
CVE-2026-0300 is an unauthenticated buffer overflow in the User-ID Authentication Portal (Captive Portal) service of PAN-OS. The vendor advisory states that exploitation yields arbitrary code execution with root privileges on PA-Series and VM-Series firewalls... exploitation has been observed since April 9, 2026, with successful remote code execution achieved by April 16, 2026. | Observed post-exploitation activity includes shellcode injection into the nginx worker process on the firewall, Active Directory enumeration using credentials extracted from the firewall, anti-forensic log cleanup, and deployment of network tunneling tools (EarthWorm, ReverseSocks5) for outbound command and control.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Earthworm tool came as a more powerful replacement to the ageing lcx/Htran one. It incorporated lcx's core concepts ... and added SOCKS5 proxy and reverse SOCKS5 proxy functionalities.
The Earthworm tool came as a more powerful replacement to the ageing lcx/Htran one. It incorporated lcx's core concepts ... and added SOCKS5 proxy and reverse SOCKS5 proxy functionalities.
After exploiting the flaw, attackers deployed tunneling tools such as EarthWorm and ReverseSocks5, used stolen credentials to probe Active Directory, and deleted logs and other evidence to hide the intrusion.
After exploiting the flaw, attackers deployed tunneling tools such as EarthWorm and ReverseSocks5, used stolen credentials to probe Active Directory, and deleted logs and other evidence to hide the intrusion.
They repeated CVE-2026-0300 exploitation on that device, achieved RCE again, and downloaded the EarthWorm and ReverseSocks5 network tunneling tools, likely to establish persistent tunneling and proxy capabilities for continued access.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Then they deployed EarthWorm and ReverseSocks5 tunnels for outbound C2
iox's port forwarding capabilities can be used to circumvent network flow restrictions... A reverse SOCKS5 proxy can also be established.
Some of the tools we saw used in post-compromise activity in those impacted since March 2 include: ... EarthWorm tunnel tool ... ReGeorg web shells ... Chisel
Then they deployed EarthWorm and ReverseSocks5 tunnels for outbound C2
Some of the tools we saw used in post-compromise activity in those impacted since March 2 include: ... Stowaway multi-hop proxy tool
Aria-body has the ability to use a reverse SOCKS proxy module... BADHATCH can use SOCKS4 and SOCKS5 proxies... GoBear implements SOCKS5 proxy functionality... Neo-reGeorg has the ability to establish a SOCKS5 proxy... Remcos uses the infected hosts as SOCKS5 proxies...
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Инструмент для SOCKS5-туннелирования и проксирования трафика, используемый после эксплуатации для C2 и пивотирования во внутреннюю сеть.
A network tunneling tool used post-exploitation to pivot through compromised PAN-OS firewalls, reduce forensic footprint, and support covert command-and-control and internal movement.
EarthWorm is an open-source tunneling tool written in C that works across Windows, Linux, macOS, and ARM/MIPS platforms. It acts as a SOCKS5 proxy and port-forwarding utility, enabling covert communication channels, bypassing network restrictions, and lateral movement within compromised environments.
Network tunneling tool used post-compromise for outbound command and control.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.