XWorm

First seen
2022-06-01 00:00:00
Malware type
ransomware, rat
Family
Malware family
Last IoC activity
2026-07-22 04:15:52
Profile updated
2026-07-07 13:14:01

Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical technology-and-telecommunications

Context

Malware with wide range of capabilities ranging from RAT to ransomware.

Detection coverage

  • 6 YARA rules

Used by threat actors

  • WebDAV Malware Delivery Activity (campaign)

Detection rules

  • RUSSIANPANDA_Win_Mal_Xworm (yara-rule)
  • EMBEERESEARCH_Win_Xworm_Simple_Strings (yara-rule)
  • SEKOIA_Xworm_Dotnet_Injector (yara-rule)
  • SEKOIA_Rat_Win_Xworm_V2 (yara-rule)
  • SEKOIA_Rat_Win_Xworm_V3 (yara-rule)
  • CAPE_Xworm (yara-rule)

Reports & references

  • sentinelone.com — Nullbulge Threat Actor Masquerades As Hacktivist Group Rebelling Against Ai (report)
  • securityintelligence.com — Hive0137 On Ai Journey (report)
  • proofpoint.com — Cant Stop Wont Stop Ta584 Innovates Initial Access (report)
  • linkedin.com — Urn:Li:Activity:7401414126620884992 (report)
  • spamhaus.org — Botnet Threat Update January To June 2025 (report)
  • spamhaus.org — Botnet Threat Update July To December 2025 (report)
  • embee-research.ghost.io — Infrastructure Analysis With Dns Pivoting (report)
  • ptsecurity.com — Steganoamor Campaign Ta558 Mass Attacking Companies And Public Institutions All Around The World (report)
  • research.checkpoint.com — Foxit Pdf Flawed Design Exploitation (report)
  • research.loginsoft.com — From Innocence To Malice The Onenote Malware Campaign Uncovered (report)
  • elastic.co — Attack Chain Leads To Xworm And Agenttesla (report)
  • proofpoint.com — Security Brief Clickfix Social Engineering Technique Floods Threat Landscape (report)
  • hunt.io — Pasteee Xworm Asyncrat Infrastructure (report)
  • cyber.wtf — Unpacking Pyarmor V8 Scripts (report)
  • redcanary.com — Network Traffic Tunneling (report)
  • gi7w0rm.medium.com — Uncovering Ddgroup A Long Time Threat Actor D3B3020625A4 (report)
  • Palo Alto Unit 42 — Nodestealer 2 Targets Facebook Business (report)
  • cyble.com — Stealth In Layers Unmasking Loader In Targeted Email Campaigns (report)
  • trustwave.com — Proton66 Part 2 Compromised Wordpress Pages And Malware Campaigns (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Xworm (report)
  • cert.pl — Deworming The Xworm (report)
  • trellix.com — Xworm V6 Exploring Pivotal Plugins (report)
  • medium.com — Xworm Malware Analysis Soc Ir Perspective On Persistence C2 And Anti Analysis Tactics Ed41D335B2Ce (report)
  • youtu.be — Tennfzm Mm0 (report)
  • sarviyamalwareanalyst.medium.com — Xworm Attack Chain Leveraging Steganography From Phishing Email To Keylogging Via C2 Communication F3A4C91Dfd06 (report)

External references