Hackers Use Fake Court Notices to Deliver XWorm Malware via Hidden Windows Scripts
Attackers are distributing XWorm malware through phishing emails containing fake Colombian court notices, leveraging hidden scripts to achieve deep system compromise.
Cybercriminals are targeting organizations in Colombia with sophisticated phishing campaigns that use fake court notices as a lure to deliver the potent XWorm remote access trojan. These emails, written in Spanish and mimicking official communications from Colombian judicial bodies, are designed to exploit the urgency associated with legal matters, prompting recipients to open malicious attachments without suspicion. The filenames of these attachments, such as "ACTA_NOTIFICA_TUTELA.js" and "PROCESO DISCIPLINARIO_ RAD_00470032.vbs," are crafted to resemble legitimate legal documents, further increasing the likelihood of compromise.
Upon opening the malicious script files, which are often concealed within ZIP archives, the infection chain begins silently. The scripts employ advanced obfuscation techniques, including custom decoders and multiple layers of encryption, to evade detection by antivirus software. This deliberate complexity makes it challenging for security tools to identify the true malicious intent of the files. The campaign's reliance on public file-hosting services like Filestack and ImageKit for second-stage payloads is also noted.
The obfuscated script ultimately triggers a hidden PowerShell command. This command then unpacks two critical components: a .NET DLL named RSG_UnityApp and the XWorm malware payload itself. In a stealthy maneuver, PowerShell injects the XWorm code into the legitimate Windows process RegAsm.exe. This technique allows the malware to operate under the guise of a trusted system utility, making it difficult for security analysts to distinguish malicious activity from normal system operations.
Once established, XWorm establishes a connection with its command and control (C2) server, transmitting sensitive system information such as username, system details, hardware configuration, antivirus status, and webcam presence. The communication is encrypted using AES-128-ECB, with each message prefixed by its length and a null byte. The malware's capabilities are extensive, including the execution of arbitrary shell commands, screen capture, file management, plugin loading, and the initiation of Distributed Denial-of-Service (DDoS) attacks.
Researchers at Arctic Wolf Labs observed that the C2 infrastructure and loaders used in this campaign bear similarities to previous XWorm and DCRat attacks. Notably, the final loader identified in this campaign matches one used in a separate XWorm incident targeting the UK in September 2026, suggesting the threat actors are actively reusing and adapting their toolkits across different operations. This reuse of infrastructure and loaders indicates a persistent and evolving threat actor.
XWorm is a commercially available Remote Access Trojan (RAT) often sold as a service, contributing to its widespread use among various cybercriminal groups. Its consistent appearance in threat rankings underscores its popularity and effectiveness. The researchers identified three distinct C2 servers, with evidence suggesting they are shared across multiple malware builds, further indicating a centralized and organized operational infrastructure.
To defend against this threat, security teams are advised to monitor for suspicious activity involving wscript.exe or cscript.exe initiating PowerShell processes, especially those with hidden or encoded commands. Additionally, flagging RegAsm.exe when it exhibits unusual behavior, such as creating suspended processes or making unexpected network connections, is crucial. Network defenders should also scrutinize DNS and firewall logs for the identified C2 domains and ports. End-users are strongly encouraged to verify any official-looking notices through separate, trusted channels and to exercise extreme caution when opening unsolicited script files.