Executive Summary
Cybersecurity researchers have identified the emergence of XWorm 6.0, a significant update to the modular malware family originally linked to the threat actor 'EvilCoder' and later 'XCoder'. The malware has transitioned from a suspected state of abandonment to a commercialized 'fully re-coded' version sold by an actor named 'XCoderTools'. This version fixes a known remote code execution (RCE) vulnerability in previous iterations and introduces a robust plugin architecture that allows it to function as a remote access trojan (RAT), infostealer, and ransomware.
The attack chain has evolved to use deceptive lures, including malicious JavaScript and LNK files that trigger PowerShell to inject XWorm into legitimate processes like RegSvcs.exe. Its modular design allows for the dynamic loading of over 35 specialized DLLs in memory, enabling tasks ranging from bypassing Chrome's app-bound encryption to deploying a modified r77 rootkit.
XWorm 6.0 represents a high risk to organizations due to its versatility and its role as a primary loader for other high-threat malware families like Remcos RAT and Snake KeyLogger. Its ability to survive system resets and evade virtualization makes it a persistent threat across various sectors.