Attackers are sending fake court notices to organizations in Colombia and using them to install XWorm, a remote access tool that gives criminals full control of an infected PC. The emails look like real legal letters.

The attached files are hidden Windows scripts that quietly start the infection. The lure works because few people ignore a message that says a court case needs urgent attention. The emails are written in Spanish and come from Colombian organizations.

The file names copy real administrative and legal papers, so a busy employee may open the file without a second thought. Behind that file sits a long chain of hidden steps, similar to the new XWorm infection chain seen last year.

Researchers at Arctic Wolf Labs published their findings on GitHub on October 26, 2026. They noted that the campaign targets Colombian organizations.

They also found that the final loader matches one used in a separate September 2026 XWorm case linked to the UK, which suggests the attackers are reusing their tools.

Hackers Use Fake Court Notices

The infection starts with an email that carries a VBScript or JavaScript file. Some files arrive inside ZIP archives, and the second-stage files are downloaded from public file-hosting services such as Filestack and ImageKit.

File names like “ACTA_NOTIFICA_TUTELA.js” and “PROCESO DISCIPLINARIO_ RAD_00470032.vbs” are meant to look like real legal papers.

Courts in Colombia are a common theme for local criminals, and the same trick appeared in Blind Eagle-linked phishing campaigns that also used fake judicial messages.

Once the victim opens the script, it does not show any warning. Instead, it unlocks a hidden PowerShell command. The script is heavily scrambled to avoid detection.

The VBScript version uses a custom Base93 decoder and several layers of encryption, while the JavaScript samples use other encryption methods and randomly generated function names. This makes it very hard for antivirus tools to spot the real purpose of the file.

The hidden PowerShell code then unpacks two files: a .NET DLL called RSG_UnityApp and the XWorm program itself. PowerShell loads the DLL and passes it the path to RegAsm.exe, a trusted Windows tool, along with the XWorm code.

The loader injects XWorm into RegAsm.exe, so the malware runs inside a program that looks normal. Security teams that only watch for unknown files can easily miss this step.

What XWorm Can Do and How to Defend Against It

After it starts, XWorm reads its hidden settings and contacts its command server. It sends back details about the PC, including the user name, system details, hardware, antivirus status, and whether a webcam is present.

Traffic is encrypted with AES-128-ECB, and every message begins with its length followed by a null byte. The researchers saw commands for running shell commands, capturing the screen, managing files, loading plugins, and starting DDoS traffic.

XWorm is sold as a service, so many criminals can buy it, and it often ranks high in weekly malware threat rankings. The researchers found three command servers, and the same servers appear in public sandbox records under different sample hashes and mutexes.

This points to several separate builds that share the same infrastructure. Arctic Wolf also saw the same loader deliver DCRat in another sample.

Defenders should watch for wscript.exe or cscript.exe starting PowerShell, especially with hidden or encoded commands. They should also flag RegAsm.exe when it runs after PowerShell, creates suspended processes, or makes network connections.

Checking DNS and firewall logs for the domains and ports below is a quick way to find infected systems. Staff should confirm any court notice through an official channel and never open unexpected script files, which are among the common XWorm delivery methods.

Indicators of compromise (IoCs):-

Type	Indicator	Notes
C2 domain/port	loganwolverin2042[.]webredirect[.]org	TCP/4521
C2 domain/port	ukranieukranie20222022[.]duckdns[.]org	TCP/3008
C2 IP/port	45[.]92[.]1[.]127	TCP/1177
C2 IP/port	77[.]110[.]114[.]115	TCP/3008
Download URL	https[:]//cdn[.]filestackcontent[.]com/B7hA66RuGnT1LRjBp2Ax	Second stage
Download URL	https[:]//cdn[.]filestackcontent[.]com/OjJYVfNcSaCemmakSzPg	Second stage
Download URL	https[:]//cdn[.]filestackcontent[.]com/dXsER20oSBCJeqtF4yq7	Second stage
Download URL	https[:]//cdn[.]filestackcontent[.]com/3LI5K6STzaI8VOvBgmga	Second stage
Download URL	https[:]//ik[.]imagekit[.]io/randiatmv9/NOTIFICA_ACTO_PROCESO_TUTELA_PDF[.]zip	Second stage
SHA256	57ae80bcc2028621086781da603110b8d6abddb840f4ba0f3395e40c8b1cbf74	Downloaded file B7hA66RuGnT1LRjBp2Ax
SHA256	6b5487998547ea629340689b76a6e7b3bdcd5f605a452ede5294fe2053b952d9	PROCESO DISCIPLINARIO_ RAD_00470032.vbs
SHA256	fe34be2cee9ba40f0e6ce4dc509ba85b79851ca9d08bf8a878602300486674e2	RSG_UnityApp .NET loader DLL
SHA256	ea0832705c8f8c368f4d4fb9eb15ddd64df1859e12af19a2e9b13280b2139bbe	XWorm payload
SHA256	554b95378744def1b8024bd01bd28f982bc093d29d847548fd0e1316e1fc19bb	Downloaded file OjJYVfNcSaCemmakSzPg
SHA256	50897e5d87ad9e05bdf9bc2cbb5b9fe1ebacb1c9a2b55a566d4ba4d10e035ab2	ACTA_NOTIFICA_TUTELA.js
SHA256	2d45e12ed77718927dbc36fa81f61333c32a549d214a651bc12043acef7fe260	XWorm payload
SHA256	a6c17d8b864940327a98e2f3b7d3b57360d2a05ce85d48cdcd38a1b5bd3a7442	Downloaded file dXsER20oSBCJeqtF4yq7
SHA256	2e91c4624bc0fcc7674bcc80d778067913daa07a3516acbfc1d08ba76ce1737f	VER_SENTENCIA_ACCION_TUTELA_PRIEMRA_INSTANCIA_200156001.js
SHA256	35b48c18d49c8c714935af51e01660da3efb5e239bc2fd7136727220e6f41130	XWorm payload
SHA256	0f202abc036b66c3fcb993d58631c63207f6ea3ac56f87051855ad2af35c0292	NOTIFICA_ACTO_PROCESO_TUTELA_PDF.js
SHA256	daf6416515b7503a1572ad4ac3a0057585238583c37eaa23d11468d10b5283a5	NOTIFICA_ACTO_PROCESO_TUTELA_PDF.zip
SHA256	7020fbd08fdde0a2c1a9c11ec11bdf3be9a6f3b58a78fbfe907fccc11eb404ca	XWorm payload
SHA256	db0e4f1afc7d9036c4561a582af57dbe0f0826b03b266c2cb99d2fb07fc5c242	Downloaded file 3LI5K6STzaI8VOvBgmga
SHA256	e514e981d7db3f74c878d7eab9ed6d1aaa3c37cd9cd239f86abcc2df6d2711ee	CUMPLIMIENTO-CONTRATO-RADICADO.js
SHA256	8da000dac095000fb4167db27aaf2810ac13a1e0815736ead22d93fefa5bb90e	XWorm payload
SHA256	cabb31719b9297b71e446fcdd4bdf4dcb9fb3f93f4d7eb8054cd7e82d11372b3	Third-party MalwareBazaar sample tied to the same endpoint
IP address	31[.]77[.]220[.]100	Resolved loganwolverin2042 on October 14
IP address	13[.]143[.]144[.]177	Resolved loganwolverin2042 on October 12, 13
IP address	45[.]88[.]186[.]191	Resolved loganwolverin2042 on October 19
IP address	77[.]110[.]114[.]115	Resolved ukranieukranie20222022 on October 19
Mutex	nLWzeTbvXzjAxooJ	Group: zzzzzzzzzzzzzzzzzzzzzzzzzzClientOTHER
Mutex	bqHmkD44JB1XWaPz	Group: MAXI073
Mutex	ELxcVIaozcn8SSiv	Group: COLEGIO
Mutex	DiIAYaBQsJDcp2xo	Group: MAXI064
Config	USB.exe	Configured file name in all four builds

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use Fake Court Notices to Deliver XWorm Malware Through Hidden Windows Scripts appeared first on Cyber Security News.