Fake Colombian court notices deliver XWorm via hidden scripts
Arctic Wolf says Spanish legal lures drop VBScript or JavaScript that inject XWorm into RegAsm.exe.
64
Country
Colombia
- Mentions · 7d3
- Mentions · 30d8
- All mentions25
- First seenAug 11, 2026
- Last mentioned2d ago
Timeline
25 articles · newest firstXWorm loader reused in phishing against Colombia and the UK
The Colombian chain uses a .NET DLL whose hash matches a September UK case, but payloads and C2 differ.
58
CyberStrikeAI’s 44 agents automated attacks on Japan organizations
Other listed targets included Taiwan, Hong Kong, the UK, France, Italy, Qatar, and Colombia.
74
Four groups bypass AI guardrails and compromise targets, CrowdStrike says
A Spanish- and English-speaking actor compromised at least 15 Argentine health care organizations.
74
OpenAI expands ChatGPT Ads to 26 more countries, now in 89
Ads remain limited to Free and Go; Plus, Pro, and Enterprise stay ad-free, and OpenAI says it does not sell conversation data.
48
Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites
Casbaneiro hides its main command channel until Latin American victims open targeted banking sites.
58
Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites
Casbaneiro banking trojan phishes Latin American users and starts banking C2 only after victims open targeted bank sites.
62
Nueva EPS, Colombia’s largest regional healthcare promoting entity has allegedly been hacked
Nueva EPS, Colombia’s largest health insurer, allegedly had 11.2 million member records stolen in a $15 million extortion attempt.
78
US sanctions 10 over ATM malware scheme tied to Tren de Aragua
OFAC sanctioned 10 people over a Ploutus ATM-jackpotting scheme that US officials link to Tren de Aragua.
65
Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data
A Chinese threat actor exploited critical WordPress vulnerabilities to steal 18,566 sensitive records from a Western government organization across 29 countries.
90
Hackers Poison Movie Torrents With MovieReaper Malware That Uses Solana for C2
Poisoned movie torrents deliver MovieReaper malware using Solana blockchain for resilient C2, infecting several hundred victims across multiple continents.
55
MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2
Kaspersky reports MovieReaper malware distributed via compromised torrent repository itorrents.org, using Solana blockchain for resilient C2 across four continents.
68
The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents
Kaspersky uncovers MovieReaper, a multi-stage malware framework spread via compromised itorrents.org torrent files, hitting hundreds of users.
64
Trezor: 347,000 users targeted in phishing attacks after Brevo breach
Trezor reported phishing after the Brevo breach targeted 347,000 newsletter subscribers, with 2,500 users clicking before the domain was taken down.
65
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
60
Trezor warns users of email provider breach, phishing attacks
Trezor says attackers breached its third-party email provider and are phishing customers with fake STM32 entropy vulnerability alerts.
58
Gigabud Uses Android App Cloning to Evade Fraud Detection
Group-IB reports the Gigabud Android banking trojan clones bank apps into isolated work profiles via the Vwork tool to evade fraud detection, with roughly $960,000 in losses in Indonesia.
52
Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.
58
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
60
Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT
SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.
72
Trezor customers hit with phishing calls and letters after shipping-partner breach
A breach at shipping partner ShipMonk exposed data for about 67,000 additional US Trezor customers, who now face phishing calls and QR scam letters.
50
Trezor data breach impact now reaches 81,000 customers
Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.
70
GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
Arctic Wolf links new Go-based GoCaracal malware with Ethereum smart-contract C2 fallback to Dark Caracal, targeting a Venezuelan communications organization.
52
17th August – Threat Intelligence Report
Colombia's Ministry of Justice suffered a ransomware attack disrupting drug-monitoring and legal public services, per Check Point's 17 August 2026 threat intelligence report.
68
No Bosses: Ancient Engineering Marvel Was Built Without Rulers, Study Suggests
A University of Cambridge-led study concludes Colombia's ancient Zenú canal network was likely built through collective labor without hierarchical rulers.
4
Related CVEs
by mentions- CVE-2025-252494%9.8Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
Appears with
- Metabasevendor · 4
- Gigabudmalware · 4
- GoldFactorythreat actor · 4
- Shelterproduct · 4
- Group-IBvendor · 4
- Kasperskyvendor · 3
- Vworkmalware · 3
- MovieReapermalware · 3
- Vworkproduct · 3
- ShinyHuntersthreat actor · 3
- ShipMonkvendor · 3
- Androidproduct · 2
- Fortinetorganization · 2
- MovieReaperproduct · 2
- Trezor customersvictim · 2
- Gigabudproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.