Back to today’s briefing

Story perspectives

XWorm Evolves: New Ransomware Trojan Gains Versatility

10/7/2025

30 6

Summary

Story summary

XWorm, first seen in 2022, is now a versatile remote access trojan with ransomware capabilities, versions 6.0–6.5.
Its modular design supports 35+ plugins for data theft and system manipulation.
It spreads mainly via phishing emails and malicious downloads, with campaigns using evasion techniques.
The original developer XCoder has stepped back; distribution is now led by XCoderTools.

1 of 1

Story summary

XWorm, first seen in 2022, is now a versatile remote access trojan with ransomware capabilities, versions 6.0–6.5.
Its modular design supports 35+ plugins for data theft and system manipulation.
It spreads mainly via phishing emails and malicious downloads, with campaigns using evasion techniques.
The original developer XCoder has stepped back; distribution is now led by XCoderTools.