XWormMalware
Malware with wide range of capabilities ranging from RAT to ransomware.From MISP Galaxy
Last reported yesterday, by SecurityWeek18 reports
ATT&CK techniques
6 of 93 · each with the sentence it comes from- T1053.005Scheduled Task
“T1053.005”
- T1056.001Keylogging
“T1056.001”
- T1027Obfuscated Files or Information
“T1027”
- T1036Masquerading
“Masquerading: Masquerade Task or Service”
- T1059.003Windows Command Shell
“T1059.003”
- T1059Command and Scripting Interpreter
“T1059.007 — Command and Scripting Interpreter: JavaScript”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
18 reports, newest first · the exact sentence from each-
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware“Related: In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit”
-
Inside SiriusQT: A Seriously Skilled RAT“SiriusQT has been observed in relation to other malware families, such as Remcos, XWorm, AsyncRAT and QuasarRAT/NJRAT, since SiriusQT operators may rely on shared or reused infrastructure.”
-
Security Affairs newsletter Round 600 by Pierluigi Paganini – INTERNATIONAL EDITION“How a leaked builder of XWorm turned a remote access trojan into a surveillance kit”
-
In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit“In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit”
-
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More“XWorm expands surveillance capabilities”
-
CikaBika Bot RAT Uses Discord for C&C“Related: XWorm RAT Evolves Into Surveillance Platform”
-
How a leaked builder of XWorm turned a remote access trojan into a surveillance kit“How a leaked builder of XWorm turned a remote access trojan into a surveillance kit”
-
Risky Bulletin: Spyware chip found in Ledger crypto-wallets“New XWorm versions: Detections for the XWorm infostealers have increased four times as the malware saw significant development this year.”
-
XWorm RAT Evolves Into Surveillance Platform“XWorm RAT Evolves Into Surveillance Platform”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“Three new malware loaders have been spotted in the wild: 2CLoader, which delivers Vidar, Remus Stealer, and XWorm RAT, AvisLoader, which is delivered via ClickFix lures and communicates via Fox, an encrypted peer-to-peer (P2P) messaging network, to fetch commands and additional p…”
-
Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX“XWorm Infrastructure Overlaps”
-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“En paralelo, variantes como Win/HoudRat y MSIL/XWorm confirmaron el uso extendido de RATs para el control no autorizado y la extracción de datos.”
-
2CLoader: A New Malware Loader Delivering Vidar and Remus“ThreatLabz has observed the loader being used to distribute information stealers including Vidar and Remus in addition to XWorm RAT.”
-
H1 2026 Malware Vulnerability Trends“AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS RAT remained in the top ten across H1 2025 and H1 2026.”
-
Cruciferra Crypter Uses Process Ghosting to Evade Detection“…rst offered for sale on the Exploit forum in autumn 2025 and now underpins dozens of campaigns delivering AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT and Snake Keylogger.”
-
The TTF Trap: A Global Campaign of a Low-Detection Lua Loader“…of fileless techniques and Lua-based loaders with low detection rates to deploy various malware families, including Agent Tesla, Remcos, XWorm, and Best Private LOGGER.”
-
Millenium: A RAT Rewritten, A Threat Multiplied“CloudSEK documented the same pattern with a trojanised XWorm builder, and it remains an active distribution trend here.”
-
Gone Phishing: An Analysis of a Targeted User Attack“Huntress’ very own Matthew Brennan analyzed the GoLang executable file and found that it was a loader for XWorm, bringing a copy of the XWorm executable along with it rather than having to reach out and download it from the Internet.”
Indicators in its reports
named in the reports above- fbijobs[.]govin 1 report
Copy this indicator · defanged
Thanks — we review every report.