Xwo
- First seen
- 2019-03-01 00:00:00
- Malware type
- credential-stealer
- Family
- Malware family
- Profile updated
- 2026-07-07 15:27:11
Context
In March 2019, AT&T Alien Labs identified a new malware family that is actively scanning for exposed web services and default passwords. Based on our findings we are calling it “Xwo” - taken from its primary module name. It is likely related to the previously reported malware families Xbash and MongoLock.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Xwo (report)
- alienvault.com — Xwo A Python Based Bot Scanner (report)