XWorm LATAM Campaign Activity

Daniel Jeremiah@daniyyell

•updated Feb 25, 2026•1•0•67

Detects network and endpoint activity associated with the XWorm LATAM campaign, including C2 communication, payload downloads, CasPol.exe making outbound connections, WMI-spawned PowerShell with Cloudinary fetches and Assembly.Load, and a specific file hash.