XWorm phishing reuses .NET loader against Colombian targets
First merged summary.
Spanish judicial phishing against Colombian organizations delivers XWorm via a .NET loader also tied to a September UK case.
Attackers are emailing Spanish fake court and administrative notices to organizations in Colombia, attaching VBScript or JavaScript, sometimes in ZIP archives, that start an XWorm infection. Arctic Wolf Labs published the findings on October 26, 2026. Scripts decode hidden PowerShell that unpacks a .NET DLL named RSG_UnityApp 1.1.0.0 and the XWorm payload, then injects it into RegAsm.exe; second-stage files come from Filestack and ImageKit. GBHackers says the loader is binary-identical to one in a September 10, 2026 UK-linked case that used JavaScript and MSBuild.exe, while payload hashes, execution targets, and command-and-control differ. The same loader also delivered DCRat in another sample. XWorm reports host details and supports shell, screen, file, plugin, and DDoS commands; traffic uses AES-128-ECB, and three command servers were identified.
- Spanish judicial lures drop VBScript or JavaScript, sometimes inside ZIP files.
- PowerShell loads RSG_UnityApp 1.1.0.0 and injects XWorm into RegAsm.exe.
- UK case used the same loader with JavaScript, MSBuild.exe, and different C2.
- The same loader delivered DCRat in a separate sample.
- XWorm traffic uses AES-128-ECB; three command servers were identified.
- Second-stage files are retrieved from Filestack and ImageKit.
Timeline
dated events in the reporting · oldest first- Sep 10, 2026UK-linked XWorm case used the same .NET loader · GBHackers
- Oct 26, 2026Arctic Wolf Labs published Colombian phishing findings · Cyber Security News
What each outlet adds
beyond the shared facts- GBHackersBinary-identical loader, UK MSBuild path, sandbox endpoint overlap
- Cyber Security NewsArctic Wolf date, named lures, AES-128-ECB, three C2s
- Vendors
- Microsoft
- Products
- RegAsm.exePowerShell
- Malware
- XWormDCRatRSG_UnityApp
- Organizations
- Arctic Wolf LabsArctic WolfFortinet
- Countries
- ColombiaUnited Kingdom
Coverage
oldest first · one row per article · UTC- · 2d ago
GBHackersFirst report
XWorm loader reused in phishing against Colombia and the UK
The Colombian chain uses a .NET DLL whose hash matches a September UK case, but payloads and C2 differ.
- · 2d ago
Cyber Security News
Fake Colombian court notices deliver XWorm via hidden scripts
Arctic Wolf says Spanish legal lures drop VBScript or JavaScript that inject XWorm into RegAsm.exe.