XWorm
- First seen
- 2022-06-01 00:00:00
- Malware type
- ransomware, rat
- Family
- Malware family
- Related IoCs
- 6034 (5827 malicious)
- Last IoC activity
- 2026-10-17 04:08:56
- Profile updated
- 2026-07-07 13:14:01
Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical technology-and-telecommunications
Context
Malware with wide range of capabilities ranging from RAT to ransomware.
Detection coverage
- 6 YARA rules
Used by threat actors
- BREEZE COMET (threat-actor)
- WebDAV Malware Delivery Activity (campaign)
Detection rules
- SEKOIA_Rat_Win_Xworm_V3 (yara-rule)
- SEKOIA_Xworm_Dotnet_Injector (yara-rule)
- SEKOIA_Rat_Win_Xworm_V2 (yara-rule)
- CAPE_Xworm (yara-rule)
- EMBEERESEARCH_Win_Xworm_Simple_Strings (yara-rule)
- RUSSIANPANDA_Win_Mal_Xworm (yara-rule)
Reports & references
- proofpoint.com — Cant Stop Wont Stop Ta584 Innovates Initial Access (report)
- linkedin.com — Urn:Li:Activity:7401414126620884992 (report)
- research.checkpoint.com — Foxit Pdf Flawed Design Exploitation (report)
- embee-research.ghost.io — Infrastructure Analysis With Dns Pivoting (report)
- ptsecurity.com — Steganoamor Campaign Ta558 Mass Attacking Companies And Public Institutions All Around The World (report)
- spamhaus.org — Botnet Threat Update July To December 2025 (report)
- spamhaus.org — Botnet Threat Update January To June 2025 (report)
- sentinelone.com — Nullbulge Threat Actor Masquerades As Hacktivist Group Rebelling Against Ai (report)
- securityintelligence.com — Hive0137 On Ai Journey (report)
- trustwave.com — Proton66 Part 2 Compromised Wordpress Pages And Malware Campaigns (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Xworm (report)
- cert.pl — Deworming The Xworm (report)
- trellix.com — Xworm V6 Exploring Pivotal Plugins (report)
- medium.com — Xworm Malware Analysis Soc Ir Perspective On Persistence C2 And Anti Analysis Tactics Ed41D335B2Ce (report)
- youtu.be — Tennfzm Mm0 (report)
- sarviyamalwareanalyst.medium.com — Xworm Attack Chain Leveraging Steganography From Phishing Email To Keylogging Via C2 Communication F3A4C91Dfd06 (report)
- kienmanowar.wordpress.com — Quicknote The Xworm Malware Is Being Spread Through A Phishing Email (report)
- malwaretrace.net — Xworm Part 1 (report)
- logpoint.com — Xworm Rat Analysis Steal Persist Control (report)
- blog.cyble.com — Evilcoder Project Selling Multiple Dangerous Tools Online (report)
- kroll.com — Xworm Returns Haunt Systems Ghost Crypt (report)
- hunt.io — Uncovering Threat Actor Tactics Xworm Delivery Strategies (report)
- youtube.com — Watch (report)
- x.com — 1694635899903152619 (report)
- securonix.com — Securonix Threat Labs Security Meme4Chan Advisory (report)