What is XWorm Official?

XWorm Official tracks versions, IOCs, news, changelogs, and MITRE techniques in 38 pages, helping defenders study malware changes and threats.

MITRE ATT&CK Center

XWorm MITRE ATT&CK Mapping

An interactive ATT&CK-style matrix mapping only techniques supported by public research. Each entry carries a technique ID, version, campaign, source, and confidence level.

Mapping policy

Only techniques supported by public research are mapped. Technique IDs are not invented. Some techniques are campaign-specific and do not generalize to every XWorm sample. Hover or tap a cell for details.

Initial Access

Execution

Persistence

Defense Evasion

Credential Access

Discovery

Collection

Command and Control

Exfiltration

Impact

Only techniques supported by public research are mapped. Technique IDs are not invented. Some techniques are campaign-specific and do not generalize to every XWorm sample.

Full Technique Table

ID	Technique	Tactic	Version	Campaign	Source	Conf.
T1566.001	Spearphishing Attachment	Initial Access	7.2	Fortinet Feb 2026	Fortinet	confirmed
T1566.002	Spearphishing Link	Initial Access	Multiple	ClickFix	Microsoft; Proofpoint	high
T1203	Exploitation for Client Execution	Execution	7.2	Fortinet Feb 2026	Fortinet	confirmed
T1059.001	PowerShell	Execution	7.2	Fortinet Feb 2026	Fortinet	confirmed
T1547.001	Registry Run Keys / Startup Folder	Persistence	7.4	Sandbox observations	Microsoft; ANY.RUN	confirmed
T1053.005	Scheduled Task	Persistence	7.4	Sandbox observations	ANY.RUN	high
T1027.002	Obfuscated / Encrypted Files	Defense Evasion	Multiple	Various	Trellix; Fortinet	high
T1055	Process Injection	Defense Evasion	7.2	Fortinet Feb 2026	Fortinet	confirmed
T1218	Signed Binary Proxy Execution	Defense Evasion	Multiple	Various	Fortinet; Trellix	high
T1555.003	Credentials from Web Browsers	Credential Access	Multiple	Various	Microsoft	confirmed
T1056.001	Keylogging	Credential Access	Multiple	Various	Microsoft; Trellix	confirmed
T1082	System Information Discovery	Discovery	7.4	Sandbox observations	ANY.RUN	confirmed
T1115	Screen Capture	Collection	Multiple	Various	Microsoft	confirmed
T1123	Audio Capture	Collection	Multiple	Various	Microsoft	high
T1125	Video Capture	Collection	Multiple	Various	Microsoft	high
T1071.001	Application-layer / Socket C2	Command and Control	Multiple	Various	Trellix; Fortinet	confirmed
T1573	Encrypted Channel	Command and Control	Multiple	Various	Researcher assessment	high
T1041	Exfiltration Over C2 Channel	Exfiltration	Multiple	Various	Researcher assessment	high
T1486	Data Encrypted for Impact	Impact	Some plugins	Various	Researcher assessment	medium
T1498	Network Denial of Service	Impact	Some plugins	Various	Researcher assessment	medium