This week, Tanium’s Cyber Threat Intelligence (CTI) team looks at the XWorm malware that recently resurfaced with more than 35 plugins, including one that enables its users to encrypt and decrypt files. Next, our team explains how Microsoft was able to identify and disrupt several sophisticated threats targeting its Teams application. Finally, we investigate the active exploitation of a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
XWorm malware reemerges with ransomware after a hiatus
Trellix has been tracking the evolution of the XWorm malware, which recently resurfaced after its original developer abandoned the project.
XWorm v6 is a sophisticated remote access trojan that uses a modular plugin system to execute a range of malicious activities including credential theft, remote control, and persistence mechanisms. This version of XWorm introduces enhanced stealth, plugin-based execution from memory, and integration with other malware families.
XWorm abandonment and resurgence
XWorm’s developer deleted their account after releasing XWorm V5.6 towards the end of 2024, leading researchers to believe it was the last version. Following this action, other actors started distributing and using cracked versions of the malware.
In June 2025, researchers discovered a new post announcing the release of XWorm V6. This version introduces a fix for an RCE vulnerability present in previous versions along with several other updates. Many people questioned whether this announcement came from the original developer of the malware or was simply someone trying to leverage the malware’s reputation.
XWorm V6: The latest version of XWorm
Trellix has recently observed an increase in samples of XWorm V6 on VirusTotal.
Campaigns using V6 of the malware start with a malicious JavaScript file that is delivered via phishing or malicious websites. This downloads and executes a PowerShell script which disables the Antimalware Scan Interface (AMSI) and delivers an injector tool. This tool injects the malicious code into a legitimate Windows program. The final payload, XWorm V6, then connects to its command-and-control (C2) server.
XWorm V6 plugins
The malware comes with a command called plugin, which enables its users to execute additional payloads. The payloads are all DLLs that get loaded and executed in memory.
Trellix logged network traffic from the malware’s C2 servers to capture the plugins being used by the malware, which is detailed in the next section. The company also observed the malware executing other malware families like DarkCloud, Phantom Stealer, Remcos RAT, and several others.
Analysis of XWorm’s plugins
XWorm now supports more than 35 plugins. These include RemoteDesktop.dll for creating remote sessions, data-stealing plugins, and FileManager.dll which grants file system access and manipulation capabilities, among others.
The malware also includes a plugin called Ransomware.dll, which enables users to encrypt and decrypt files. When the operator uses this ransomware plugin, they can customize what image should be used as the desktop wallpaper, the BTC address, an email ID, and the ransom amount.
Trellix details several of these plugins in the report, for those looking for a more technical read.
Analyst comments from Tanium’s Cyber Threat Intelligence team
XWorm V6 represents an evolution in modular malware, enabling attackers to deploy highly targeted capabilities with minimal footprint. The sheer number of modules available in V6 makes it possible for actors to tailor its functionality for each target, making threat detection and response more complex.
XWorm’s advanced persistence techniques, credential theft modules, and integration with other malware families makes it a powerful tool for both espionage and financial attacks, especially those involving long-term compromise.
Microsoft disrupts multiple threats targeting Teams
Microsoft has identified and disrupted a range of sophisticated cyber threats targeting its Teams application, including social engineering, malware delivery, and abuse of collaboration features by both criminal and nation-state actors.
While not entirely specific to Teams, some open-source frameworks exist that can “enumerate less secure users, groups, and tenants in Teams,” according to Microsoft. The open-source tools can enumerate various aspects of Microsoft Teams, even revealing the user’s current availability status if certain privacy settings are not enabled.
To defend against threats facing Microsoft Teams, Microsoft continues to improve its protections against fake Entra ID tenants along with threat actor abuse of free tenants and trial subscriptions. The company also outlines a multi-layered defense strategy across identity, endpoints, apps, and data to help organizations proactively mitigate evolving risks.
Initial access
Threat actors are using a few different lures as part of their initial access involving Microsoft Teams. One such lure is the infamous tech support scam which results in downloading a remote monitoring and management (RMM) tool.
An example of this can be seen in an attack carried out by Storm-1811, which impersonated tech support and attempting to fix an issue with large quantities of junk mail that the actor themselves had created. RMM tools were subsequently downloaded and used to deliver malware and ransomware payloads.
Microsoft also calls out the example in which Midnight Blizzard impersonated tech support to get victims to verify their accounts and enter authentication codes for access. Deepfakes and AI will only help to make this social engineering via Teams more effective.
Persistence
For persistence in these attacks, threat actors are abusing shortcuts in the startup folder to help execute malicious tools and are also exploiting accessibility features, like sticky keys. Actors could also create guest user accounts within tenants they have access to maintain access.
Microsoft calls out the instance in which Storm-2373 exploited device code authentication flows to capture authentication tokens. The actor engaged victims in Teams chats to build rapport before prompting them to authenticate and steal the token.
Execution and privilege escalation
Admin accounts are beneficial for threat actors, as they come with the necessary elevated privileges for them to engage in further malicious activity. Outside of these admin accounts, actors also go after the more everyday user and trick them into opening links or files sent via Teams, similar to when they are sent via email.
For privilege escalation, actors have been observed registering devices they control and trying to change permission groups.
Credential access
An actor with a valid refresh token can easily impersonate users with the help of Teams APIs. There are several admin level tools that could be repurposed by threat actors to intercept tokens. Additionally, the actor could use password spraying to obtain credentials.
Discovery
Threat actors are also known to leverage Microsoft Teams for discovery, analyzing Teams configuration data and enumerating apps if they have access.
Microsoft gives the example of Void Blizzard, an actor that leveraged AzureHound and enumerated an organization’s Microsoft Entra ID configuration. The actor was able to discover details about users, roles, groups, apps, and so on. The actor was also able to access some Teams conversations.
Lateral movement and collection
Microsoft notes how if an actor gains admin access to Teams, they could potentially “leverage external communication settings and enable trust relationships between organizations to move laterally.”
Actors may also try to mine Teams for other information and data collection that could be useful in furthering their objectives.
C2 and exfiltration
Actors will try to deliver malware via Teams, often via file attachments. Some tools even specifically come with features to create C2 channels with Microsoft Teams.
Actors may use also use Teams messages for exfiltration. As Microsoft notes, there are tools created specifically for this purpose.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The continued exploitation of Microsoft Teams highlights how collaboration platforms have become integral to modern attack surfaces, requiring defenders to treat them with the same scrutiny as traditional endpoints and email systems.
Additionally, the use of legitimate tenants and branding by attackers to gain trust is a stark reminder that identity verification must go beyond surface-level indicators, especially in environments where external collaboration is common.
Microsoft’s report is full of helpful mitigation and protection guidance along with Defender detections and hunting queries to help identify and protect against this threat.
Storm-1175 exploits a critical GoAnywhere MFT vulnerability
Microsoft has identified the active exploitation of a critical vulnerability (CVE-2025-10035) in GoAnywhere MFT, allowing unauthenticated remote code execution via a forged license response.
Storm-1175, a financially-motivated threat actor, is actively leveraging this flaw to deploy ransomware and exfiltrate data—prompting urgent mitigation and patching recommendations.
[Learn how modern vulnerability managements helps turn chaos into confidence]
About CVE-2025-10035
Last month, a security advisory was released detailing the CVE-2025-10035 vulnerability in GoAnywhere MFT’s license servlet. This vulnerability received a CVSS score of 10, and could lead to command injection and remote code execution. Microsoft has since observed a threat actor tracked as Storm-1175 exploiting this vulnerability.
The vulnerability is a deserialization flaw within GoAnywhere’s MFT License Servlet Admin Console. It impacts versions up to 7.8.3 and would “enable an attacker to bypass signature verification by crafting a forged license response signature, which then allows the deserialization of arbitrary, attacker-controlled objects.” Exploitation supposedly doesn’t require the attacker to authenticate if they are able to craft or intercept license responses which increases the risk of the flaw.
According to Microsoft, this vulnerability could enable attackers to carry out system and user discovery along with the deployment of additional tools—all while maintaining long term access.
Storm-1175 and CVE-2025-10035
Microsoft has observed Storm-1175 exploiting this vulnerability in multistage attacks. For initial access, the actor exploits the vulnerability within GoAnywhere MFT. And for persistence, they used RMM tools for which they dropped the binaries within the GoAnywhere MFT process.
The actor could then use discovery commands and deploy additional tools before moving laterally throughout the network. The RMM tools were again used for C2 purposes and data was executed. In one observed case, Medusa ransomware was also deployed.
Analyst comments from Tanium’s Cyber Threat Intelligence team
It’s important to note that Storm-1175 began exploiting CVE-2025-10035 before public disclosure. This proves how threat actors are becoming increasingly adept at identifying and weaponizing zero-day vulnerabilities, often faster than defenders can respond.
Because GoAnywhere MFT is widely used in enterprise environments for secure file transfers, this vulnerability is a prime example of how a single flaw in a third-party tool can have cascading impact.
Microsoft has also included mitigation and protection guidance in the report.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.