lwxat
Unknown Dormant
- Mentions
- 1
- First seen
- 19 May 2026
- Last seen
- 19 May 2026
Origin
Unattributed
Profile
lwxat is a Chinese-speaking threat actor associated with a commodity BadIIS ecosystem. This Malware-as-a-Service infrastructure targets IIS web servers. The actor is mentioned in a report tracking this ecosystem.
Affected vendors
Microsoft
Associated malware / tools
BadIIS