Threat Intelligence / Actor / lwxat (developer) / multiple Chinese-speaking cybercrime groups (operators)

lwxat (developer) / multiple Chinese-speaking cybercrime groups (operators)

Nation: China (developer and operator language assessment) · 1 tracked threat(s) · Categories: MALWARE

Also known as: lwxat, lwxatisme, x神 (xshen) customer cluster

Tracked threats

BadIIS 'demo.pdb' Commodity MaaS Ecosystem — Cisco Talos Tracks 'lwxat' Author Toolchain Used by Chinese-Speaking Cybercrime Groups (2021-2026) — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence