Malwarehigh
Fake Colombian court notices deliver XWorm via hidden scripts
Original title: Hackers Use Fake Court Notices to Deliver XWorm Malware Through Hidden Windows Scripts
AI summary · x-ai/grok-4.7Summaries by Vani AI
Arctic Wolf says Spanish legal lures drop VBScript or JavaScript that inject XWorm into RegAsm.exe.
Attackers email Spanish fake court notices to organizations in Colombia, attaching VBScript or JavaScript files, sometimes inside ZIP archives, that start an XWorm infection. Arctic Wolf Labs published findings on October 26, 2026. Scripts decode a hidden PowerShell command that unpacks a .NET DLL named RSG_UnityApp and the XWorm payload, then injects it into RegAsm.exe. Second-stage files are pulled from Filestack and ImageKit. The same loader also delivered DCRat in another sample, and researchers say it matches a September 2026 UK-linked XWorm case.
Unconfirmed: A matching loader suggests reuse with a UK-linked September 2026 case, but shared operators are not confirmed.
Key facts
- Named lures include ACTA_NOTIFICA_TUTELA.js and a disciplinary-process VBS file.
- XWorm reports host details and supports shell, screen, files, plugins, and DDoS commands.
- Traffic uses AES-128-ECB; three command servers were identified.
- Defenders are told to watch wscript or cscript launching encoded PowerShell and RegAsm after PowerShell.
Security assessment · AI, from the article
Impact: Remote control of infected PCs, including shell and screen capture
What to do
- 1.Watch for wscript.exe or cscript.exe starting hidden or encoded PowerShell.
- 2.Flag RegAsm.exe launched after PowerShell, creating suspended processes, or making network connections.
- 3.Confirm court notices through official channels and do not open unexpected script files.
- Vendors
- Microsoft
- Products
- RegAsm.exePowerShell
- Malware
- XWormDCRatRSG_UnityApp
- Organizations
- Arctic Wolf Labs
- Countries
- ColombiaUnited Kingdom
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn.filestackcontent.com | P/port 77[.]110[.]114[.]115 TCP/3008 Download URL https[:]//cdn[.]filestackcontent[.]com/B7hA66RuGnT1LRjBp2Ax Second stage Download URL https[:] |
| domain | ik.imagekit.io | om/3LI5K6STzaI8VOvBgmga Second stage Download URL https[:]//ik[.]imagekit[.]io/randiatmv9/NOTIFICA_ACTO_PROCESO_TUTELA_PDF[.]zip Secon |
| domain | loganwolverin2042.webredirect.org | of compromise (IoCs):- Type Indicator Notes C2 domain/port loganwolverin2042[.]webredirect[.]org TCP/4521 C2 domain/port ukranieukranie20222022[.]duckdn |
| domain | ukranieukranie20222022.duckdns.org | ganwolverin2042[.]webredirect[.]org TCP/4521 C2 domain/port ukranieukranie20222022[.]duckdns[.]org TCP/3008 C2 IP/port 45[.]92[.]1[.]127 TCP/1177 C2 IP/po |
| ipv4 | 13.143.144.177 | 0[.]100 Resolved loganwolverin2042 on October 14 IP address 13[.]143[.]144[.]177 Resolved loganwolverin2042 on October 12, 13 IP addre |
| ipv4 | 31.77.220.100 | y MalwareBazaar sample tied to the same endpoint IP address 31[.]77[.]220[.]100 Resolved loganwolverin2042 on October 14 IP address 1 |
| ipv4 | 45.88.186.191 | 177 Resolved loganwolverin2042 on October 12, 13 IP address 45[.]88[.]186[.]191 Resolved loganwolverin2042 on October 19 IP address 7 |
| ipv4 | 45.92.1.127 | ukranieukranie20222022[.]duckdns[.]org TCP/3008 C2 IP/port 45[.]92[.]1[.]127 TCP/1177 C2 IP/port 77[.]110[.]114[.]115 TCP/3008 Dow |
| ipv4 | 77.110.114.115 | g TCP/3008 C2 IP/port 45[.]92[.]1[.]127 TCP/1177 C2 IP/port 77[.]110[.]114[.]115 TCP/3008 Download URL https[:]//cdn[.]filestackconten |
| sha256 | 0f202abc036b66c3fcb993d58631c63207f6ea3ac56f87051855ad2af35c0292 | 1660da3efb5e239bc2fd7136727220e6f41130 XWorm payload SHA256 0f202abc036b66c3fcb993d58631c63207f6ea3ac56f87051855ad2af35c0292 NOTIFICA_ACTO_PROCESO_TUTELA_PDF.js SHA256 daf6416515b7503a |
| sha256 | 2d45e12ed77718927dbc36fa81f61333c32a549d214a651bc12043acef7fe260 | b1c9a2b55a566d4ba4d10e035ab2 ACTA_NOTIFICA_TUTELA.js SHA256 2d45e12ed77718927dbc36fa81f61333c32a549d214a651bc12043acef7fe260 XWorm payload SHA256 a6c17d8b864940327a98e2f3b7d3b57360d2a0 |
| sha256 | 2e91c4624bc0fcc7674bcc80d778067913daa07a3516acbfc1d08ba76ce1737f | d38a1b5bd3a7442 Downloaded file dXsER20oSBCJeqtF4yq7 SHA256 2e91c4624bc0fcc7674bcc80d778067913daa07a3516acbfc1d08ba76ce1737f VER_SENTENCIA_ACCION_TUTELA_PRIEMRA_INSTANCIA_200156001.js |
| sha256 | 35b48c18d49c8c714935af51e01660da3efb5e239bc2fd7136727220e6f41130 | NTENCIA_ACCION_TUTELA_PRIEMRA_INSTANCIA_200156001.js SHA256 35b48c18d49c8c714935af51e01660da3efb5e239bc2fd7136727220e6f41130 XWorm payload SHA256 0f202abc036b66c3fcb993d58631c63207f6ea |
| sha256 | 50897e5d87ad9e05bdf9bc2cbb5b9fe1ebacb1c9a2b55a566d4ba4d10e035ab2 | d0e1316e1fc19bb Downloaded file OjJYVfNcSaCemmakSzPg SHA256 50897e5d87ad9e05bdf9bc2cbb5b9fe1ebacb1c9a2b55a566d4ba4d10e035ab2 ACTA_NOTIFICA_TUTELA.js SHA256 2d45e12ed77718927dbc36fa81f6 |
| sha256 | 554b95378744def1b8024bd01bd28f982bc093d29d847548fd0e1316e1fc19bb | 15ddd64df1859e12af19a2e9b13280b2139bbe XWorm payload SHA256 554b95378744def1b8024bd01bd28f982bc093d29d847548fd0e1316e1fc19bb Downloaded file OjJYVfNcSaCemmakSzPg SHA256 50897e5d87ad9e0 |
| sha256 | 57ae80bcc2028621086781da603110b8d6abddb840f4ba0f3395e40c8b1cbf74 | /NOTIFICA_ACTO_PROCESO_TUTELA_PDF[.]zip Second stage SHA256 57ae80bcc2028621086781da603110b8d6abddb840f4ba0f3395e40c8b1cbf74 Downloaded file B7hA66RuGnT1LRjBp2Ax SHA256 6b5487998547ea6 |
| sha256 | 6b5487998547ea629340689b76a6e7b3bdcd5f605a452ede5294fe2053b952d9 | 395e40c8b1cbf74 Downloaded file B7hA66RuGnT1LRjBp2Ax SHA256 6b5487998547ea629340689b76a6e7b3bdcd5f605a452ede5294fe2053b952d9 PROCESO DISCIPLINARIO_ RAD_00470032.vbs SHA256 fe34be2cee9b |
| sha256 | 7020fbd08fdde0a2c1a9c11ec11bdf3be9a6f3b58a78fbfe907fccc11eb404ca | 11468d10b5283a5 NOTIFICA_ACTO_PROCESO_TUTELA_PDF.zip SHA256 7020fbd08fdde0a2c1a9c11ec11bdf3be9a6f3b58a78fbfe907fccc11eb404ca XWorm payload SHA256 db0e4f1afc7d9036c4561a582af57dbe0f0826 |
| sha256 | 8da000dac095000fb4167db27aaf2810ac13a1e0815736ead22d93fefa5bb90e | f86abcc2df6d2711ee CUMPLIMIENTO-CONTRATO-RADICADO.js SHA256 8da000dac095000fb4167db27aaf2810ac13a1e0815736ead22d93fefa5bb90e XWorm payload SHA256 cabb31719b9297b71e446fcdd4bdf4dcb9fb3f |
| sha256 | a6c17d8b864940327a98e2f3b7d3b57360d2a05ce85d48cdcd38a1b5bd3a7442 | f61333c32a549d214a651bc12043acef7fe260 XWorm payload SHA256 a6c17d8b864940327a98e2f3b7d3b57360d2a05ce85d48cdcd38a1b5bd3a7442 Downloaded file dXsER20oSBCJeqtF4yq7 SHA256 2e91c4624bc0fcc |
| sha256 | cabb31719b9297b71e446fcdd4bdf4dcb9fb3f93f4d7eb8054cd7e82d11372b3 | af2810ac13a1e0815736ead22d93fefa5bb90e XWorm payload SHA256 cabb31719b9297b71e446fcdd4bdf4dcb9fb3f93f4d7eb8054cd7e82d11372b3 Third-party MalwareBazaar sample tied to the same endpoint |
| sha256 | daf6416515b7503a1572ad4ac3a0057585238583c37eaa23d11468d10b5283a5 | 1855ad2af35c0292 NOTIFICA_ACTO_PROCESO_TUTELA_PDF.js SHA256 daf6416515b7503a1572ad4ac3a0057585238583c37eaa23d11468d10b5283a5 NOTIFICA_ACTO_PROCESO_TUTELA_PDF.zip SHA256 7020fbd08fdde0a |
| sha256 | db0e4f1afc7d9036c4561a582af57dbe0f0826b03b266c2cb99d2fb07fc5c242 | 1bdf3be9a6f3b58a78fbfe907fccc11eb404ca XWorm payload SHA256 db0e4f1afc7d9036c4561a582af57dbe0f0826b03b266c2cb99d2fb07fc5c242 Downloaded file 3LI5K6STzaI8VOvBgmga SHA256 e514e981d7db3f7 |
| sha256 | e514e981d7db3f74c878d7eab9ed6d1aaa3c37cd9cd239f86abcc2df6d2711ee | 99d2fb07fc5c242 Downloaded file 3LI5K6STzaI8VOvBgmga SHA256 e514e981d7db3f74c878d7eab9ed6d1aaa3c37cd9cd239f86abcc2df6d2711ee CUMPLIMIENTO-CONTRATO-RADICADO.js SHA256 8da000dac095000fb4 |
| sha256 | ea0832705c8f8c368f4d4fb9eb15ddd64df1859e12af19a2e9b13280b2139bbe | 08bf8a878602300486674e2 RSG_UnityApp .NET loader DLL SHA256 ea0832705c8f8c368f4d4fb9eb15ddd64df1859e12af19a2e9b13280b2139bbe XWorm payload SHA256 554b95378744def1b8024bd01bd28f982bc093 |
| sha256 | fe34be2cee9ba40f0e6ce4dc509ba85b79851ca9d08bf8a878602300486674e2 | fe2053b952d9 PROCESO DISCIPLINARIO_ RAD_00470032.vbs SHA256 fe34be2cee9ba40f0e6ce4dc509ba85b79851ca9d08bf8a878602300486674e2 RSG_UnityApp .NET loader DLL SHA256 ea0832705c8f8c368f4d4fb |
From the original article
4 min read at cybersecuritynews.com
Attackers are sending fake court notices to organizations in Colombia and using them to install XWorm, a remote access tool that gives criminals full control of an infected PC. The emails look like real legal letters. The attached files are hidden Windows scripts that quietly start the infection.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.