Dorifel (aka Quervar, XDoc Crypt)
Summary: Dorifel, also known as Quervar or XDocCrypt, is a worm allegedly related to the Citadel trojan that has been found worldwide but has particularly affected the Netherlands over the past several weeks. Once executed, it searches for all Microsoft Word documents on the system, including network shares, encrypts them with an RC4 key, and prepends the virus body to each encrypted document.
What's compelling: This worm reaches network shares, so a single execution can encrypt Word documents well beyond the infected machine, and its initial infector carries references to "Breaking Bad" and "Scarface" in plaintext and ROT13.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026