XWorm V6.0 Resurfaces: Modular RAT Returns with Ransomware Plugin and Advanced Evasion

According to Trellix ARC, XWorm has resurfaced as XWorm V6.0, a modular RAT now featuring a ransomware plugin and advanced evasion techniques. The analysis notes the malware’s expanded plugin capabilities, persistence methods, and a linkage to ransomware operations, with XWorm originally developed by a threat actor known as XCoder.

On 4 June 2025, a new actor calling themselves XCoderTools announced the release of XWorm V6.0 on hackforums, claiming a fix for a previously identified RCE vulnerability alongside other updates. Trellix researchers outline a campaign beginning with a malicious JavaScript file delivered via phishing, followed by a PowerShell script that disables AMSI and an injector that loads the malware into a legitimate Windows process such as RegSvcs.exe.

The XWorm V6.0 client then connects to a C2 server and operates with a toolkit of over 35 DLL-based modules, including RemoteDesktop.dll, Stealer and WindowsUpdate.dll, FileManager.dll and Webcam.dll, with a ransomware plugin that encrypts and decrypts files using AES-CBC and customises ransom notes.