Live Tracking
XWorm Activity Tracker
Latest verified sample date, latest verified version, recent campaigns, IOC additions, and research publications.
Latest verified version
7.4
Last verified
2026-10-04
Last observation
2026-10-02
Recent IOC additions
9
Is XWorm still active?
Yes. Current public sandbox and malware-distribution data demonstrate continued XWorm activity during 2026. ANY.RUN's malware trend data showed XWorm observations as recently as October 2, 2026. URLhaus records XWorm payload activity extending through 2026.
Recently observed campaigns
2026-08-28·URLhaus
URLhaus records continued XWorm payload distribution
2026-07-01·Public reporting
xplogs22 cluster reported using XWorm against Russia/CIS targets
2026-05-14·Point Wild / Lat61·v7.4
Point Wild / Lat61 documents XWorm 7.4 multi-stage infection chain
2026-04-02·ANY.RUN·v7.4
ANY.RUN analyzes XWorm 7.4 sample
2026-02-10·FortiGuard Labs·v7.2
FortiGuard Labs documents XWorm 7.2 in multilingual phishing campaign
2025-06-27·Trellix·v6.0
Trellix reports cracked XWorm 6.0 builder appearing publicly
2025-06-04·Trellix·v6.0
XCoderTools advertises XWorm 6.0
