XWorm, a name increasingly familiar in threat intelligence circles, has once again proven its status as a top-tier remote access trojan (RAT)—and a serious threat to enterprise security. In their latest deep dive, the Splunk Threat Research Team (STRT) unpacks how XWorm is used not only as a foothold for cybercriminals but also as a delivery vehicle for ransomware campaigns, including those linked to the notorious LockBit group.