The Reveal Platform
Intel Name: Xworm’s shape-shifting arsenal: loader and stager variants in the wild
Date of Scan: July 3, 2025
Impact: High
Summary: XWorm is a widely used and evolving remote access trojan (RAT) known for features like keylogging, remote access, and data theft. Its modular design, ease of use, and regular updates make it attractive to cybercriminals. Threat actors often use XWorm in attacks on the software supply chain and gaming sectors. In one campaign, XWorm and AsyncRAT were used to gain access and deploy ransomware built with the leaked LockBit Black builder.
