Hackers Use Fake Court Notices to Deliver XWorm via Hidden Windows Scripts

Attackers are sending forged court notifications to organizations in Colombia and using those messages to install XWorm, a remote access tool that gives operators full control of an infected machine. The emails are designed to appear like legitimate legal correspondence.

The attachments are hidden Windows scripts that silently begin the infection chain. The lure is effective because recipients are unlikely to ignore a message that claims a court matter requires urgent attention. The emails are written in Spanish and appear to originate from Colombian institutions.

Attachment names mimic real administrative and legal documents so that a busy employee might open them without hesitation. Behind each file is a multi-stage, heavily obfuscated chain similar to other XWorm delivery methods observed previously.

Researchers at Arctic Wolf Labs published their analysis on GitHub on October 26, 2026 and noted the campaign’s focus on Colombian targets. They also observed that the final loader matches one used in a separate September 2026 XWorm incident tied to the U.K., suggesting reuse of tooling.

Hackers Use Fake Court Notices

The attack begins with an email containing a VBScript or JavaScript file. Some samples are packaged inside ZIP archives, and second-stage payloads are downloaded from public file-hosting services such as Filestack and ImageKit.

File names like “ACTA_NOTIFICA_TUTELA.js” and “PROCESO DISCIPLINARIO_ RAD_00470032.vbs” are chosen to resemble genuine legal paperwork. Courts in Colombia are a recurring theme in local criminal phishing, and similar judicial-themed lures have appeared in campaigns linked to the threat actor known as Blind Eagle.

When the victim opens the script, no visible warning appears. Instead the script unlocks a hidden PowerShell command. The scripts are heavily obfuscated to evade detection: the VBScript samples use a custom Base93 decoder and multiple encryption layers, while the JavaScript samples rely on other encryption techniques and randomly generated function names. These measures make it difficult for antivirus engines to determine the files’ true purpose.

The decrypted PowerShell then unpacks two files: a .NET DLL named RSG_UnityApp and the XWorm executable. PowerShell loads the DLL and supplies it with the path to RegAsm.exe (a trusted Microsoft utility) along with the XWorm binary. The loader injects XWorm into RegAsm.exe so the malware runs inside a legitimate-looking process, a technique that can evade defenses that only look for unknown binaries.

What XWorm Can Do and How to Defend Against It

Once executed, XWorm reads its embedded configuration and contacts its command-and-control (C2) server. It transmits details about the infected machine, including the username, system and hardware information, antivirus status, and whether a webcam is present.

Network traffic is encrypted with AES-128-ECB; each message is prefixed with its length followed by a null byte. The researchers observed commands to run shell commands, capture screenshots, manage files, load plugins, and initiate distributed-denial-of-service (DDoS) activity.

XWorm is offered as malware-as-a-service, allowing many criminal customers to purchase and deploy it; it frequently appears high in weekly malware rankings. The researchers identified three command servers and found the same infrastructure appearing in public sandbox records under different sample hashes and mutexes, indicating multiple builds that share the same backend. Arctic Wolf also observed the same loader delivering DCRat in a different sample.

Defenders should monitor for wscript.exe or cscript.exe launching PowerShell—especially when commands are hidden or encoded. They should also flag instances of RegAsm.exe that are launched by PowerShell, create suspended processes, or make unexpected network connections. Reviewing DNS and firewall logs for the domains and ports listed below is a fast way to locate potential infections. Staff should verify any court notice through official channels and never open unexpected script files, which are a common XWorm delivery method.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, using [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.