XWorm loader reused in phishing against Colombia and the UK
Original title: Hackers Reuse XWorm Malware Loader Across Phishing Campaigns Targeting Colombia and the UK
The Colombian chain uses a .NET DLL whose hash matches a September UK case, but payloads and C2 differ.
A judicial-themed phishing campaign against Colombian organizations delivers XWorm through obfuscated VBScript or JavaScript, encrypted PowerShell, and a reusable .NET loader. That loader is binary-identical to one documented in a September 10, 2026 UK-linked case, while payload hashes, execution targets, and command-and-control differ. Three recovered endpoints also appear in public sandbox records for other XWorm builds, and another sample delivers DCRat through the same loader.
Unconfirmed: Matching loader hashes show reuse, not that the Colombia and UK cases share an operator.
- Spanish emails attached VBScript and JavaScript posed as judicial or administrative documents.
- PowerShell reflectively loads RSG_UnityApp 1.1.0.0 with a RegAsm.exe path and XWorm bytes.
- The UK case used JavaScript and MSBuild.exe with a different payload and C2.
- Supported commands include RunShell, plugin loading, host-file operations, and StartDDos.
Impact: Remote control and host data collection after phishing
- 1.Hunt for the listed XWorm C2 domains and IPs on TCP 4521, 3008, and 1177.
- 2.Block unexpected judicial-themed VBScript and JavaScript email attachments.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1059.001 PowerShellT1027 Obfuscated Files or InformationT1620 Reflective Code LoadingT1218.009 Regsvcs/Regasm
- Organizations
- Arctic WolfFortinet
- Countries
- ColombiaUnited Kingdom
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | loganwolverin2042.webredirect.org | tically distinct. IOCs C2 Domain / IP Address Protocol Port loganwolverin2042[.]webredirect[.]org TCP 4521 ukranieukranie20222022[.]duckdns[.]org TCP 300 |
| domain | ukranieukranie20222022.duckdns.org | rotocol Port loganwolverin2042[.]webredirect[.]org TCP 4521 ukranieukranie20222022[.]duckdns[.]org TCP 3008 45[.]92[.]1[.]127 TCP 1177 77[.]110[.]114[.]11 |
| ipv4 | 45.92.1.127 | rg TCP 4521 ukranieukranie20222022[.]duckdns[.]org TCP 3008 45[.]92[.]1[.]127 TCP 1177 77[.]110[.]114[.]115 TCP 3008 Note: IP addre |
| ipv4 | 77.110.114.115 | 0222022[.]duckdns[.]org TCP 3008 45[.]92[.]1[.]127 TCP 1177 77[.]110[.]114[.]115 TCP 3008 Note: IP addresses and domains are intention |
From the original article
3 min read at gbhackers.com
A judicial-themed phishing campaign targeting Colombian organizations that delivers XWorm through obfuscated scripts, encrypted PowerShell, and a reusable . NET loader. The recovered loader is binary-identical to one documented in a September 10, 2026, UK-linked case, connecting otherwise differently packaged delivery chains.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.