Northrecon - APT's

Threat Actors

Black Basta

Ransomware

First seen: "n/a"

Ransomware | Espionage

Country of Origin: China

Incident #2

Critical

February 17, 2025 03:36 UTC

XWorm Attack Campaign

A highly evasive, multi-stage attack that leverages Cloudflare Tunnels, WebDAV abuse, and advanced memory execution techniques—ultimately leading to XWorm and Cobalt Strike deployment.