Threat Actor
lwxat
- First Reported
- May 21, 2026
- Latest Reported
- May 21, 2026
Reported Context (1)
- Alias of the BadIIS malware author, who is reported to have made supplementary deployment and persistence tools available for the BadIIS offering. Webworm Adds EchoCreep and GraphWorm Backdoors Using Discord and Microsoft Graph API
Malware (7)
People (2)
Threat Actors (5)
Vendors (1)
Products (5)
Tools (8)
Industries (4)
Countries (11)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.