Malware
XRed
According to eSentire, XRed, also known as Synaptics worm, is a backdoor that has been circulating since at least 2019.
XRed is a Windows malware family.
Background
Per eSentire, XRed (also called the Synaptics worm) is a backdoor active since at least 2019, originally distributed via drivers shipped with USB-C hub adapters. After running, it copies itself, sets a Windows Registry Run key for persistence, and relies on a mutex named Synaptics2X to limit itself to a single running instance. Its remote-control and exfiltration capabilities include pulling extra payloads from hardcoded URLs, shipping system details (MAC address, username, computer name) to fixed email addresses over SMTP, and logging keystrokes through keyboard hooks; supported commands cover shell access, screenshots, enumerating drives and folders, file downloads, and file deletion. The malware also behaves like a worm, propagating via USB drives using an autorun.inf file and infecting macro-enabled Excel files (.xlsm) with a malicious VBA macro. It contacts its command-and-control server through the hardcoded dynamic DNS domain xred.mooo.com—a distinctive indicator—and eSentire notes that language clues in the code point to a developer who is a native Turkish speaker.
Source: Malpedia (Fraunhofer FKIE).