Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 02:10:46 UTC
Home > List all groups > List all tools > List all groups using tool XServer
 Tool: XServer
Names
XServer
Filesnfer
Category Malware
Type Tunneling
Description
(Fox-IT) Several tools appear to be used exclusively by this actor. One of those tools, named
XServer according to the source code, provides proxy/tunneling functionality which is used for
lateral movement.
Information
<https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf>
Malpedia <https://malpedia.caad.fkie.fraunhofer.de/details/win.xserver>
Last change to this tool card: 24 April 2021
Download this tool card in JSON format
All groups using tool XServer
Changed Name Country Observed
APT groups
  APT 20, Violin Panda 2014-2017  
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a4a42490-f65f-4de4-a356-e4a48c03abe2
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a4a42490-f65f-4de4-a356-e4a48c03abe2
Page 1 of 1