# XWorm Reborn: Modular XWorm 6.x RAT Evolves from Infostealer to Surveillance and Extortion Platform (Netskope)

> Netskope Threat Labs published 'XWorm Reborn: From infostealer to surveillance platform' on the evolution of the XWorm RAT. The Netskope article body could not be retrieved, so technical detail is drawn from corroborating Trellix-derived reporting on XWorm 6.0/6.4, which describes a plugin-based platform with 35+ DLL modules covering credential theft, remote desktop, webcam capture, rootkit and ransomware.

- **Published:** 2026-10-12T14:33:09Z
- **Last reviewed:** 2026-10-12T14:33:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3363
- **ID:** TL-2026-3363
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** XCoderTools
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

XWorm is a commodity .NET remote access trojan that emerged in 2022. Its original developer, XCoder, abandoned the project in the second half of 2024 (deleted Telegram account); the last official release was 5.6, which contained an RCE flaw exploitable by anyone holding the C2 encryption key. A trojanized 5.6 builder distributed via GitHub and Telegram was reported to have infected 18,459 devices. On 4 June 2025 a seller named XCoderTools advertised a 'fully re-coded' XWorm 6.0 on hackforums.net for a $500 lifetime licence, with the RCE fixed. Versions 6.0, 6.4 and 6.5 are now used by multiple unrelated operators.

Provenance note: the Netskope article cited by the hunt (https://www.netskope.com/blog/xworm-reborn-from-infostealer-to-surveillance-platform) returned only its 120-character title on every retrieval attempt, and the related Netskope XWorm posts were also unreadable. Nothing below is attributed to Netskope's body text. Technical detail comes from secondary reporting of the Trellix XWorm V6 research (Niranjan Hegde and Sijo Jacob), plus Picus Security, The Hacker News, Cyber Security News, UV Cyber, TecnetOne and VC Solutions. The 'reborn' framing and the infostealer-to-surveillance characterisation match those sources.

Delivery chain (XWorm 6.0 campaigns): a phishing email carries a malicious JavaScript file (or .LNK) that shows a decoy PDF while PowerShell runs in the background. The PowerShell stage disables AMSI (AmsiUtils::ToggleAmsi(false)), drops an injector DLL and the XWorm client to %TEMP%, and runs the injector via rundll32.exe. The injector hollows or injects into the legitimate RegSvcs.exe, which then connects to the C2. Other reported lures include executables disguised as Discord, .XLAM files with embedded shellcode, trojanized ScreenConnect installers, and AI-themed lures.

Capabilities: the core client is a loader for plugins. The C2 sends a 'plugin' command carrying a SHA-256 hash; if the client does not already hold the plugin, it requests the Base64-encoded DLL and loads it in memory. Reported plugins include RemoteDesktop.dll, Shell.dll (hidden cmd.exe execution), FileManager.dll (with AES-CBC file encryption), Stealer.dll, Chromium.dll, merged.dll and SystemCheck.Merged.dll (browser credentials and cookies; Chrome v20 app-bound encryption bypass reported), Recovery.dll and WindowsUpdate.dll (Windows key and Wi-Fi password theft), Webcam.dll, Informations.dll, TCPConnections.dll, ActiveWindows.dll, StartupManager.dll, Rootkit.dll (r77 rootkit), ResetSurvival.dll (persistence via C:\Recovery\OEM\ResetConfig.xml) and Ransomware.dll (ransom note 'How To Decrypt My Files.html', wallpaper change; reported to overlap with NoCry). The client ID is a hash of processor count, user name, machine name, OS version and drive total size, and plugin state is stored under HKCU\SOFTWARE\<CLIENT_ID>. The default AES key is reported as '666666' / '<666666>'. XWorm 6.0 has also been used to deliver DarkCloud Stealer, Hworm, Snake KeyLogger, Phantom Stealer, Phemedrone Stealer and Remcos RAT. Trellix found XWorm 6.0 builders on VirusTotal that were themselves infected with XWorm.

Severity is raised from the hunt's provisional MEDIUM to HIGH because the sourced capabilities include ransomware, rootkit and credential theft. No CVE is associated with the 6.x family; the 5.6 RCE flaw has no assigned CVE in the sources.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools
- T1055.012 Process Hollowing
- T1218.011 Rundll32
- T1014 Rootkit
- T1497.001 System Checks
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1005 Data from Local System
- T1125 Video Capture
- T1573.001 Symmetric Cryptography

## Sources

- [XWorm Reborn: From infostealer to surveillance platform - Netskope](https://www.netskope.com/blog/xworm-reborn-from-infostealer-to-surveillance-platform)
- [Netskope Threat Labs Uncovers New XWorm's Stealthy Techniques](https://www.netskope.com/blog/netskope-threat-labs-uncovers-new-xworms-stealthy-techniques)
- [XWorm V6: Advanced Evasion and AMSI Bypass Capabilities Revealed - Netskope](https://www.netskope.com/blog/xworm-v6-0-enhanced-malware-protection-and-stealthy-delivery)
- [XWorm V6: Exploring Pivotal Plugins - Trellix](https://trellix.com/blogs/research/xworm-v6-exploring-pivotal-plugins)
- [XWorm 6.0 Returns with 35 Plugins and Ransomware Module - The Hacker News](https://thehackernews.com/2025/10/xworm-60-returns-with-35-plugins-and.html)
- [New XWorm V6 Variant Injects Malicious Code - Cyber Security News](https://cybersecuritynews.com/new-xworm-v6-variant-injects-malicious-code/)
- [XWorm Malware Resurfaces with Ransomware Module, Over 35 Plugins - BleepingComputer](https://www.bleepingcomputer.com/news/security/xworm-malware-resurfaces-with-ransomware-module-over-35-plugins/)
- [XWorm Rises Again: Dissecting the Modular Malware's V6 Resurrection - Picus Security](https://www.picussecurity.com/resource/blog/xworm-rises-again-dissecting-the-modular-malwares-v6-resurrection)
- [Threat Advisory: XWorm6.x - UV Cyber](https://www.uvcyber.com/resources/reports/threat-advisory-xworm6.x)
- [The Return of XWorm: Malware with Ransomware and 35 Active Plugins - TecnetOne](https://blog.tecnetone.com/en-us/xworm-the-malware-that-returns-with-ransomware)
- [XWorm 6 New Variants Impacting Your Security - VC Solutions](https://www.vcsolutions.com/blog/xworm-6-new-variants-impacting-your-security/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3363