tokens: Our telemetry shows that H-W0rm is one of the most active RATs we ve seen, with infections observed across virtually all enterprise verticals and geographies in which Fidelis Cybersecurity products are deployed.