Threat video1:00
XWorm CV Lure in Russian ICS Q4 2025: Detection & IOCs
Kaspersky's Russia ICS report ties a CV-disguised XWorm lure to its October 2025 peak, with 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for Kaspersky ICS CERT: Threat Landscape for Industrial Automation… →
Chapters
- 0:00The hookAbout 15.6 percent of Russian industrial systems.
- 0:05The storyResume-themed phishing targeted industrial organizations.
- 0:13Attack pathEmails disguise XWorm as resume attachments with obfuscation.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise1 indicator to hunt: 1 file name.
- 0:38MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to impact.
- 0:43Remediation3 steps now: Block executable attachments at the email gateway.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 15.6 percent of Russian industrial systems.
0:05Resume-themed phishing targeted industrial organizations.
0:09A worm-backdoor grants remote control and persistence.
0:14Emails disguise XWorm as resume attachments with obfuscation.
0:18Opening it grants persistence and remote control.
0:21It spreads via removable media and launches cryptominers.
0:28No threat actor is attributed. Confidence: low.
0:331 indicator to hunt: 1 file name.
0:388 ATT&CK techniques, from initial access to impact.
0:433 steps now: Block executable attachments at the email gateway.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.