Xworm 3.1 [new] Jun 2026

XPI modules are compiled to , signed with an Ed25519 certificate, and loaded at runtime. This design ensures:

October 26, 2023 Classification: Public / TLP:WHITE Prepared by: Threat Intelligence Unit xworm 3.1

Based on our analysis, we give Xworm 3.1 a rating of 4/5. While it offers impressive features and performance, its potential for malicious use and the associated security risks prevent us from giving it a perfect score. XPI modules are compiled to , signed with

For detailed technical breakdowns of these campaigns, you can refer to security reports from SonicWall and SOCRadar . Malicious PDF delivering Xworm 3.1 payload - SonicWall XPI modules are compiled to

XWorm 3.1’s C2 communication is what makes it operationally effective.