Threat reportMalwareTL-2026-3363
XWorm Reborn: Modular XWorm 6.x RAT Evolves from Infostealer to Surveillance and Extortion Platform (Netskope)
XWorm Reborn (TL-2026-3363), also tracked as XWorm, is a high-severity malware campaign, first published 2026-10-12. It is attributed to XCoderTools with low confidence, affects Microsoft Windows, maps to 16 MITRE ATT&CK techniques (T1005, T1014, T1055.012), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 1XCoderTools
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-3363
- Threat ID
- TL-2026-3363
- Also known as
- XWorm, XWorm V6, XWorm 6.0, XWorm 6.4, XWorm 6.5
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- XCoderTools
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- general enterprise, cryptocurrency users, software developers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in XWorm Reborn
Malware and tooling: 404 Keylogger, Phemedrone Stealer, Remcos, XWorm, r77, ScreenConnect
How XWorm Reborn works
Netskope Threat Labs published 'XWorm Reborn: From infostealer to surveillance platform' on the evolution of the XWorm RAT. The Netskope article body could not be retrieved, so technical detail is drawn from corroborating Trellix-derived reporting on XWorm 6.0/6.4, which describes a plugin-based platform with 35+ DLL modules covering credential theft, remote desktop, webcam capture, rootkit and ransomware.
XWorm is a commodity .NET remote access trojan that emerged in 2022. Its original developer, XCoder, abandoned the project in the second half of 2024 (deleted Telegram account); the last official release was 5.6, which contained an RCE flaw exploitable by anyone holding the C2 encryption key. A trojanized 5.6 builder distributed via GitHub and Telegram was reported to have infected 18,459 devices. On 4 June 2025 a seller named XCoderTools advertised a 'fully re-coded' XWorm 6.0 on hackforums.net for a $500 lifetime licence, with the RCE fixed. Versions 6.0, 6.4 and 6.5 are now used by multiple unrelated operators.
Provenance note: the Netskope article cited by the hunt (https://www.netskope.com/blog/xworm-reborn-from-infostealer-to-surveillance-platform) returned only its 120-character title on every retrieval attempt, and the related Netskope XWorm posts were also unreadable. Nothing below is attributed to Netskope's body text. Technical detail comes from secondary reporting of the Trellix XWorm V6 research (Niranjan Hegde and Sijo Jacob), plus Picus Security, The Hacker News, Cyber Security News, UV Cyber, TecnetOne and VC Solutions. The 'reborn' framing and the infostealer-to-surveillance characterisation match those sources.
Delivery chain (XWorm 6.0 campaigns): a phishing email carries a malicious JavaScript file (or .LNK) that shows a decoy PDF while PowerShell runs in the background. The PowerShell stage disables AMSI (AmsiUtils::ToggleAmsi(false)), drops an injector DLL and the XWorm client to %TEMP%, and runs the injector via rundll32.exe. The injector hollows or injects into the legitimate RegSvcs.exe, which then connects to the C2. Other reported lures include executables disguised as Discord, .XLAM files with embedded shellcode, trojanized ScreenConnect installers, and AI-themed lures.
Capabilities: the core client is a loader for plugins. The C2 sends a 'plugin' command carrying a SHA-256 hash; if the client does not already hold the plugin, it requests the Base64-encoded DLL and loads it in memory. Reported plugins include RemoteDesktop.dll, Shell.dll (hidden cmd.exe execution), FileManager.dll (with AES-CBC file encryption), Stealer.dll, Chromium.dll, merged.dll and SystemCheck.Merged.dll (browser credentials and cookies; Chrome v20 app-bound encryption bypass reported), Recovery.dll and WindowsUpdate.dll (Windows key and Wi-Fi password theft), Webcam.dll, Informations.dll, TCPConnections.dll, ActiveWindows.dll, StartupManager.dll, Rootkit.dll (r77 rootkit), ResetSurvival.dll (persistence via C:\Recovery\OEM\ResetConfig.xml) and Ransomware.dll (ransom note 'How To Decrypt My Files.html', wallpaper change; reported to overlap with NoCry). The client ID is a hash of processor count, user name, machine name, OS version and drive total size, and plugin state is stored under HKCU\SOFTWARE\<CLIENT_ID>. The default AES key is reported as '666666' / '<666666>'. XWorm 6.0 has also been used to deliver DarkCloud Stealer, Hworm, Snake KeyLogger, Phantom Stealer, Phemedrone Stealer and Remcos RAT. Trellix found XWorm 6.0 builders on VirusTotal that were themselves infected with XWorm.
Severity is raised from the hunt's provisional MEDIUM to HIGH because the sourced capabilities include ransomware, rootkit and credential theft. No CVE is associated with the 6.x family; the 5.6 RCE flaw has no assigned CVE in the sources.
MITRE ATT&CK techniques used in TL-2026-3363
Collection
T1005 Data from Local System; T1125 Video Capture
Defense Evasion
T1014 Rootkit; T1055.012 Process Hollowing; T1218.011 Rundll32; T1497.001 System Checks
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.007 JavaScript; T1204.002 Malicious File
Discovery
T1082 System Information Discovery
Persistence
T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
T1566.001 Spearphishing Attachment
Command and Control
T1573.001 Symmetric Cryptography
defense-impairment
Affected products and versions in XWorm Reborn
- Microsoft — Windows
Vulnerable versions: Windows endpoints (XWorm is a .NET RAT; specific versions not stated in sources)
Remediation for XWorm Reborn
Patches
- No vendor patch applies; this is commodity malware, not a software vulnerability
Immediate actions
- Block outbound connections to 94.159.113.64 (TCP/4411) and hunt historical logs for it
- Quarantine hosts where RegSvcs.exe is spawned or injected by rundll32.exe or PowerShell, and hosts that created C:\Recovery\OEM\ResetConfig.xml
- Reset credentials and invalidate browser sessions for users on affected hosts
Workarounds
- Use application control to restrict script hosts and rundll32.exe execution from user-writable paths such as %TEMP%
Longer-term hardening
- Block or open .js/.jse/.lnk email attachments in Notepad or a sandbox rather than Windows Script Host
- Enable AMSI and PowerShell script block logging and alert on AMSI tampering
- Deploy EDR with process-injection and rootkit detection
- Restrict unsanctioned remote-access tools such as ScreenConnect
Timeline of XWorm Reborn
- Increased XWorm samples observed on VirusTotal (month-level precision, per TecnetOne)
- Reporting on an evolved XWorm infection chain (month-level precision, per TecnetOne)
- XCoderTools advertises a 'fully re-coded' XWorm 6.0 on hackforums.net for $500 lifetime access, with the v5.6 RCE flaw fixed
- Cyber Security News publishes Trellix-derived analysis of the XWorm V6 JavaScript/PowerShell chain with injection into RegSvcs.exe
- TecnetOne reports XWorm's return with a ransomware module and 35 active plugins
- The Hacker News reports Trellix findings: 35+ plugins, C2 94.159.113.64:4411, XWorm 6.0 builders infected with XWorm
- UV Cyber publishes a threat advisory on XWorm 6.x
- Picus Security publishes detailed V6 plugin, persistence and ATT&CK analysis
Sources cited for XWorm Reborn
- XWorm Reborn: From infostealer to surveillance platform - Netskope
- Netskope Threat Labs Uncovers New XWorm's Stealthy Techniques
- XWorm V6: Advanced Evasion and AMSI Bypass Capabilities Revealed - Netskope
- XWorm V6: Exploring Pivotal Plugins - Trellix
- XWorm 6.0 Returns with 35 Plugins and Ransomware Module - The Hacker News
- New XWorm V6 Variant Injects Malicious Code - Cyber Security News
- XWorm Malware Resurfaces with Ransomware Module, Over 35 Plugins - BleepingComputer
- XWorm Rises Again: Dissecting the Modular Malware's V6 Resurrection - Picus Security
- Threat Advisory: XWorm6.x - UV Cyber
- The Return of XWorm: Malware with Ransomware and 35 Active Plugins - TecnetOne
- XWorm 6 New Variants Impacting Your Security - VC Solutions
Detection coverage for TL-2026-3363
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3363 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.