XWorm Malware Indicators of Compromise

On November 4, 2026, ThreatFox reported 15 new indicators of compromise (IOCs) associated with the XWorm malware, a Windows-based remote access trojan (RAT). The identified infrastructure includes active command-and-control (C2) servers and hashes for malicious payloads currently circulating in the wild.

Impact

XWorm is a multi-purpose RAT capable of data exfiltration, system manipulation, and serving as a secondary payload delivery mechanism. The newly identified C2 infrastructure represents potential active command-and-control channels for compromised endpoints.

Recommendation

• Implement blocking for the provided C2 IP addresses and domain at the network perimeter.
• Scan endpoint and email gateway environments for the identified malicious file hashes.
• Monitor for suspicious network connections originating from Windows hosts to the identified non-standard ports (e.g., 7007, 7575, 4445).