MalwarePublished 6 Oct 2025

XWorm V6: Exploring Pivotal Plugins

Source AlienVault OTX General

Description

Since the release of XWorm V6.0 on June 4, 2025, we have noted a surge in samples identified as XWorm V6.0 on VirusTotal, reflecting its rapid adoption by threat actors. One prominent campaign illustrates its delivery: a malicious JavaScript (JS) file initiates a PowerShell (PS1) script, which deploys an injector to deliver the XWorm Client.

Impact

For European organizations, XWorm V6 poses significant risks primarily through unauthorized remote access and data exfiltration. The malware’s ability to bypass AMSI and execute obfuscated PowerShell scripts complicates detection and response efforts, potentially allowing attackers to maintain long-term persistence. Confidentiality is at risk due to credential theft and file management capabilities, while integrity and availability may be compromised through remote desktop control and process injection, which can be used to manipulate or disrupt critical systems. Sectors such as finance, healthcare, government, and critical infrastructure in Europe are particularly vulnerable due to their reliance on Windows-based environments and remote management tools. The phishing-based delivery vector increases the attack surface, especially in organizations with less mature email security and user awareness programs. The medium severity rating reflects the malware’s potent capabilities balanced against the need for user interaction and the absence of zero-day exploits. However, the rapid adoption of XWorm V6 by threat actors suggests a growing threat landscape that could escalate if combined with targeted campaigns or supply chain compromises.

Defensive guidance

European organizations should implement layered defenses focusing on detection and prevention of script-based attacks. Specific recommendations include: 1) Enforce strict PowerShell execution policies, such as constrained language mode and script signing requirements, to limit unauthorized script execution. 2) Deploy advanced endpoint detection and response (EDR) solutions capable of identifying AMSI bypass attempts, process injection, and anomalous remote desktop sessions. 3) Harden email gateways with robust phishing detection, sandboxing, and URL filtering to block malicious JavaScript attachments and links. 4) Conduct regular user training focused on phishing awareness and safe handling of email attachments. 5) Monitor network traffic for unusual command and control patterns associated with XWorm’s communication techniques. 6) Implement application whitelisting to restrict execution of unauthorized scripts and binaries. 7) Maintain up-to-date backups and incident response plans to quickly recover from potential compromises. 8) Utilize threat intelligence feeds to stay informed about emerging XWorm variants and indicators of compromise. These measures, combined with proactive hunting for suspicious PowerShell and JavaScript activity, will reduce the risk and impact of XWorm V6 infections.

Indicators of compromise

Hashes 32

a11466bee082a37915c25b84f839a728MD5 of 570e4d52b259b460aa17e8e286be64d5bada804bd4757c2475c0e34a73aeb869
0be606b363366742133a6c316736bab6bca54831SHA1 of 570e4d52b259b460aa17e8e286be64d5bada804bd4757c2475c0e34a73aeb869
570e4d52b259b460aa17e8e286be64d5bada804bd4757c2475c0e34a73aeb869
25e304f15acb97cab8a6b685d8c8ef05MD5 of 6a0c1f70af17bd9258886f997bb43266aa816ff24315050bbf5f0e473d059485
56d0e1e06598562c8fa70c657464cf77MD5 of 000185a17254cd8863208d3828366ec25ddd01596f18e57301355d4a33eac242
75f51daff0696bb59f14a9b3f12d3578MD5 of d46bb31dc93b89d67abffe144c56356167c9e57e3235bfb897eafc30626675bb
cbdfd0de5b3cda140b2213213218993eMD5 of 1990659a28b2c194293f106e98f5c5533fdad91e50fdeb1a9590d6b1d2983ada
43b5045c089b7ddca49352dc6cd883c1d9d76c9eSHA1 of 1990659a28b2c194293f106e98f5c5533fdad91e50fdeb1a9590d6b1d2983ada
45bd7a00225cf42644965e7f61f26f060ac56d98SHA1 of d46bb31dc93b89d67abffe144c56356167c9e57e3235bfb897eafc30626675bb
70ab393489e5924d64b99e15526ddfbaa749523dSHA1 of 000185a17254cd8863208d3828366ec25ddd01596f18e57301355d4a33eac242

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Oct 2025, 19:04 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Hashes 32

Community reviews

Related threats