Fake Colombian Court Notices Deliver XWorm Through Scripts and RegAsm Injection
A phishing campaign is targeting Colombian organizations with Spanish-language fake court notices that deliver the XWorm remote access trojan through malicious VBScript and JavaScript attachments. The obfuscated scripts launch PowerShell to load the RSG_UnityApp .NET loader, which injects XWorm into the legitimate Windows process RegAsm.exe. XWorm collects system information and supports remote command execution, screenshots, file management, plugin loading, and distributed denial-of-service activity over encrypted command-and-control connections. Arctic Wolf Labs identified infrastructure reuse across multiple builds and loader overlap with a September 2026 UK-linked XWorm case. The same loader also delivered DCRat in another sample, indicating tool reuse but not establishing a common operator or attribution to a named threat actor. Defenders should prioritize detection of script interpreters spawning PowerShell, investigate suspicious RegAsm.exe behavior, and monitor connections to the command-and-control infrastructure identified in the reporting.. Fonte: https://mallory.ai/stories/01a182cb-230f-7ddc-a080-4160427f5923
Itagora tiene in archivio titolo e sommario per la ricerca interna. Il testo completo resta sulla fonte. Il link in uscita non invia referrer.