Campaign Activity
XWorm Campaigns in 2026
Documented XWorm campaign activity during 2026. Commodity malware can be used simultaneously by many unrelated operators — campaigns are not combined into a single threat actor.
AUTHOR: Threat Intelligence Research TeamUPDATED: 2026-10-04VERIFIED: 2026-10-04
Attribution caution
XWorm is commodity malware. Do not combine unrelated campaigns into a single threat actor. The developer, seller, cracker, malware operator, and phishing operator are distinct roles.
Feb 2026
Fortinet multilingual phishing (XWorm 7.2)
Business-themed phishing with malicious Excel exploiting CVE-2018-0802.
VERSION: 7.2SOURCE: FortiGuard Labs
Mar–May 2026
XWorm 7.4 sandbox submissions
Independent researchers and sandbox submissions document XWorm 7.4.
VERSION: 7.4SOURCE: ANY.RUN; Point Wild
Jul 2026
xplogs22 cluster (Russia/CIS)
Public reporting describes xplogs22 using XWorm against Russia/CIS targets.
SOURCE: Public reporting
Aug 2026
URLhaus distribution
URLhaus continues recording XWorm distribution infrastructure.
SOURCE: URLhaus
Sep 2026
Continued sandbox submissions
Public sandbox systems continue receiving XWorm-associated malicious files.
SOURCE: Sandbox telemetry
Oct 2026
ANY.RUN trend telemetry
ANY.RUN trend telemetry continues recording XWorm activity.
SOURCE: ANY.RUN
XWorm 7.2 Infection Chain (Fortinet, Feb 2026)
PHISHING EMAIL
↓
MALICIOUS EXCEL
↓
CVE-2018-0802
↓
HTA / SCRIPT STAGE
↓
POWERSHELL / MEMORY LOADER
↓
PROCESS INJECTION
↓
XWORM 7.2
↓
C2 COMMUNICATION
Fortinet observed the XWorm payload operating as a 32-bit .NET executable with version information UD_XWormClient 7.2. The diagram is defensive and conceptual; no weaponized files or scripts are reproduced.
