Earthworm
- Malware type
- webshell
- Family
- Malware family
- Last IoC activity
- 2026-06-29 00:44:50
- Profile updated
- 2026-07-07 13:17:04
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
According to Cisco Talos, Earthworm is network tunneling tool that has extensively been used by Chinese-speaking threat actors in intrusions to expose internal endpoints to attacker-owned remote infrastructure.
Detection coverage
- 3 YARA rules
Detection rules
- SEKOIA_Hacktool_Earthworm_Strings (yara-rule)
- SIGNATURE_BASE_MAL_Earthworm_Socks_Proxy_ID_Generation (yara-rule)
- MALPEDIA_Win_Earthworm_Auto (yara-rule)
Reports & references
- Cisco Talos — Uat 8837 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Earthworm (report)