Threat video1:00
XWorm ICS Phishing Wave Europe Q4 2025: Detection & IOCs
The Curriculum-vitae-catalina lure pushed XWorm up across Europe's ICS in Q4 2025: 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for XWorm ICS Phishing Wave Europe Q4 2025: Detection & IOCs →
Chapters
- 0:00The hookPhishing malware hit industrial automation systems across Europe.
- 0:05The storyJob-application emails spread across Europe in waves.
- 0:12Attack pathAccording to reports, phishing delivered malware.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise1 indicator to hunt: 1 file name.
- 0:39MITRE ATT&CK techniques9 ATT&CK techniques, from initial access to command and control.
- 0:44Remediation3 steps now: Block or quarantine executable attachments at the email gateway.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Phishing malware hit industrial automation systems across Europe.
0:05Job-application emails spread across Europe in waves.
0:09Detections peaked across Europe in November.
0:12According to reports, phishing delivered malware.
0:15The malware was obfuscated to evade detection.
0:18It persisted on infected systems and established control.
0:22Command-and-control operated on ICS systems.
0:25Detections surged.
0:29No threat actor is attributed. Confidence: low.
0:341 indicator to hunt: 1 file name.
0:399 ATT&CK techniques, from initial access to command and control.
0:443 steps now: Block or quarantine executable attachments at the email gateway.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.