Hackers Use Fake Court Notices to Deliver XWorm Malware Through Hidden Windows Scripts

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com


Attackers are sending fake court notices to organizations in Colombia and using them to install XWorm, a remote access tool that gives criminals full control of an infected PC. The emails look like real legal letters.

The attached files are hidden Windows scripts that quietly start the infection. The lure works because few people ignore a message that says a court case needs urgent attention. The emails are written in Spanish and come from Colombian organizations.

The file names copy real administrative and legal papers, so a busy employee may open the file without a second thought. Behind that file sits a long chain of hidden steps, similar to the new XWorm infection chain seen last year.

Researchers at Arctic Wolf Labs published their findings on GitHub on October 26, 2026. They noted that the campaign targets Colombian organizations.

They also found that the final loader matches one used in a separate September 2026 XWorm case linked to the UK, which suggests the attackers are reusing their tools.

Hackers Use Fake Court Notices

The infection starts with an email that carries a VBScript or JavaScript file. Some files arrive inside ZIP archives, and the second-stage files are downloaded from public file-hosting services such as Filestack and ImageKit.

File names like “ACTA_NOTIFICA_TUTELA.js” and “PROCESO DISCIPLINARIO_ RAD_00470032.vbs” are meant to look like real legal papers.

Courts in Colombia are a common theme for local criminals, and the same trick appeared in Blind Eagle-linked phishing campaigns that also used fake judicial messages.

Once the victim opens the script, it does not show any warning. Instead, it unlocks a hidden PowerShell command. The script is heavily scrambled to avoid detection.

The VBScript version uses a custom Base93 decoder and several layers of encryption, while the JavaScript samples use other encryption methods and randomly generated function names. This makes it very hard for antivirus tools to spot the real purpose of the file.

The hidden PowerShell code then unpacks two files: a .NET DLL called RSG_UnityApp and the XWorm program itself. PowerShell loads the DLL and passes it the path to RegAsm.exe, a trusted Windows tool, along with the XWorm code.

The loader injects XWorm into RegAsm.exe, so the malware runs inside a program that looks normal. Security teams that only watch for unknown files can easily miss this step.

What XWorm Can Do and How to Defend Against It

After it starts, XWorm reads its hidden settings and contacts its command server. It sends back details about the PC, including the user name, system details, hardware, antivirus status, and whether a webcam is present.

Traffic is encrypted with AES-128-ECB, and every message begins with its length followed by a null byte. The researchers saw commands for running shell commands, capturing the screen, managing files, loading plugins, and starting DDoS traffic.

XWorm is sold as a service, so many criminals can buy it, and it often ranks high in weekly malware threat rankings. The researchers found three command servers, and the same servers appear in public sandbox records under different sample hashes and mutexes.

This points to several separate builds that share the same infrastructure. Arctic Wolf also saw the same loader deliver DCRat in another sample.

Defenders should watch for wscript.exe or cscript.exe starting PowerShell, especially with hidden or encoded commands. They should also flag RegAsm.exe when it runs after PowerShell, creates suspended processes, or makes network connections.

Checking DNS and firewall logs for the domains and ports below is a quick way to find infected systems. Staff should confirm any court notice through an official channel and never open unexpected script files, which are among the common XWorm delivery methods.

Indicators of compromise (IoCs):-

Type Indicator Notes
C2 domain/port loganwolverin2042[.]webredirect[.]org TCP/4521
C2 domain/port ukranieukranie20222022[.]duckdns[.]org TCP/3008
C2 IP/port 45[.]92[.]1[.]127 TCP/1177
C2 IP/port 77[.]110[.]114[.]115 TCP/3008
Download URL https[:]//cdn[.]filestackcontent[.]com/B7hA66RuGnT1LRjBp2Ax Second stage
Download URL https[:]//cdn[.]filestackcontent[.]com/OjJYVfNcSaCemmakSzPg Second stage
Download URL https[:]//cdn[.]filestackcontent[.]com/dXsER20oSBCJeqtF4yq7 Second stage
Download URL https[:]//cdn[.]filestackcontent[.]com/3LI5K6STzaI8VOvBgmga Second stage
Download URL https[:]//ik[.]imagekit[.]io/randiatmv9/NOTIFICA_ACTO_PROCESO_TUTELA_PDF[.]zip Second stage
SHA256 57ae80bcc2028621086781da603110b8d6abddb840f4ba0f3395e40c8b1cbf74 Downloaded file B7hA66RuGnT1LRjBp2Ax
SHA256 6b5487998547ea629340689b76a6e7b3bdcd5f605a452ede5294fe2053b952d9 PROCESO DISCIPLINARIO_ RAD_00470032.vbs
SHA256 fe34be2cee9ba40f0e6ce4dc509ba85b79851ca9d08bf8a878602300486674e2 RSG_UnityApp .NET loader DLL
SHA256 ea0832705c8f8c368f4d4fb9eb15ddd64df1859e12af19a2e9b13280b2139bbe XWorm payload
SHA256 554b95378744def1b8024bd01bd28f982bc093d29d847548fd0e1316e1fc19bb Downloaded file OjJYVfNcSaCemmakSzPg
SHA256 50897e5d87ad9e05bdf9bc2cbb5b9fe1ebacb1c9a2b55a566d4ba4d10e035ab2 ACTA_NOTIFICA_TUTELA.js
SHA256 2d45e12ed77718927dbc36fa81f61333c32a549d214a651bc12043acef7fe260 XWorm payload
SHA256 a6c17d8b864940327a98e2f3b7d3b57360d2a05ce85d48cdcd38a1b5bd3a7442 Downloaded file dXsER20oSBCJeqtF4yq7
SHA256 2e91c4624bc0fcc7674bcc80d778067913daa07a3516acbfc1d08ba76ce1737f VER_SENTENCIA_ACCION_TUTELA_PRIEMRA_INSTANCIA_200156001.js
SHA256 35b48c18d49c8c714935af51e01660da3efb5e239bc2fd7136727220e6f41130 XWorm payload
SHA256 0f202abc036b66c3fcb993d58631c63207f6ea3ac56f87051855ad2af35c0292 NOTIFICA_ACTO_PROCESO_TUTELA_PDF.js
SHA256 daf6416515b7503a1572ad4ac3a0057585238583c37eaa23d11468d10b5283a5 NOTIFICA_ACTO_PROCESO_TUTELA_PDF.zip
SHA256 7020fbd08fdde0a2c1a9c11ec11bdf3be9a6f3b58a78fbfe907fccc11eb404ca XWorm payload
SHA256 db0e4f1afc7d9036c4561a582af57dbe0f0826b03b266c2cb99d2fb07fc5c242 Downloaded file 3LI5K6STzaI8VOvBgmga
SHA256 e514e981d7db3f74c878d7eab9ed6d1aaa3c37cd9cd239f86abcc2df6d2711ee CUMPLIMIENTO-CONTRATO-RADICADO.js
SHA256 8da000dac095000fb4167db27aaf2810ac13a1e0815736ead22d93fefa5bb90e XWorm payload
SHA256 cabb31719b9297b71e446fcdd4bdf4dcb9fb3f93f4d7eb8054cd7e82d11372b3 Third-party MalwareBazaar sample tied to the same endpoint
IP address 31[.]77[.]220[.]100 Resolved loganwolverin2042 on October 14
IP address 13[.]143[.]144[.]177 Resolved loganwolverin2042 on October 12, 13
IP address 45[.]88[.]186[.]191 Resolved loganwolverin2042 on October 19
IP address 77[.]110[.]114[.]115 Resolved ukranieukranie20222022 on October 19
Mutex nLWzeTbvXzjAxooJ Group: zzzzzzzzzzzzzzzzzzzzzzzzzzClientOTHER
Mutex bqHmkD44JB1XWaPz Group: MAXI073
Mutex ELxcVIaozcn8SSiv Group: COLEGIO
Mutex DiIAYaBQsJDcp2xo Group: MAXI064
Config USB.exe Configured file name in all four builds

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use Fake Court Notices to Deliver XWorm Malware Through Hidden Windows Scripts appeared first on Cyber Security News.