Threat reportMalwareTL-2026-4643
XWorm .NET Loader (RSG_UnityApp) Reused Across Judicial-Themed Phishing Campaigns Targeting Colombia and the UK
XWorm .NET Loader (RSG_UnityApp) Reused Across (TL-2026-4643) is a high-severity malware campaign, first published 2026-10-28. It has no confirmed attribution, affects Microsoft Windows (endpoints with .NET Framework utilities MSBuild.exe, maps to 13 MITRE ATT&CK techniques (T1027.013, T1059.001, T1059.005), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4643
- Threat ID
- TL-2026-4643
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target regions
- colombia, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in XWorm .NET Loader (RSG_UnityApp) Reused Across
Malware and tooling: DCRat, RSG_UnityApp, XWorm, Crypto Obfuscator, DCRAT - S9017
How XWorm .NET Loader (RSG_UnityApp) Reused Across works
Spanish-language judicial-themed phishing emails delivered VBScript/JavaScript attachments that decode and run encrypted PowerShell, reflectively loading a .NET DLL (RSG_UnityApp 1.1.0.0) that runs XWorm inside RegAsm.exe (MSBuild.exe also reported). The loader is reported as binary-identical to one documented in a September 10, 2026 UK-linked case, indicating loader reuse rather than common attribution; DCRat was also delivered via the same loader.
Phishing emails written in Spanish impersonate judicial correspondence from Colombian organizations and carry VBScript and JavaScript attachments disguised as administrative documents. The scripts are protected with generated identifiers, misleading configuration variables and encrypted string concatenation, and use a custom Base93 decoder (symbol pairs packed into 13- or 14-bit values under a threshold-dependent rule). Further layers use keyed substitution and bit-manipulation block transforms (8-byte and 12-byte blocks with table lookups, word mixing and XOR, chained in a CBC-like construction), AES-256-CBC, and alternative SM4-CBC / Square-CBC combinations with XOR-obfuscated keys. The PowerShell unpacker uses Base52 encoding (seven bytes represented by ten characters) and an RC4-inspired stream generator.
PowerShell reflectively loads a .NET DLL, assembly name RSG_UnityApp version 1.1.0.0, protected with Crypto Obfuscator. It invokes a public static method with six arguments, including the path to RegAsm.exe, and the final payload (XWorm, or alternatively DCRat) executes inside a trusted .NET utility process (RegAsm.exe; MSBuild.exe also reported in the campaign summary).
The XWorm configuration is decrypted with AES-256-ECB using MD5(mutex) as key. Network traffic is TCP, with messages delimited by <XWormmm> and encrypted with AES-128-ECB, each prefixed with a decimal byte length and a NUL separator. The initial INFO beacon discloses username, OS details, install date, elevation status, webcam availability, hardware specifications and antivirus status. Supported commands include update, DW, FM, LN, RunShell, $Cap, plugin, savePlugin, StartDDos and host-file operations; managed-assembly plugins extend functionality.
The loader is reported as binary-identical to one documented in a UK-linked case dated September 10, 2026, while payload hashes, execution targets and C2 configurations differ. Three of the four C2 endpoints appear in public sandbox records with various builds, mutexes and group values. The source stresses that loader identity, payload configuration and infrastructure must be kept analytically distinct: loader reuse is not evidence of a common actor. No actor attribution, CVE or file hashes are given in the source. Severity is analyst-assigned. Arctic Wolf, Buschbeck and Fortinet (parallel Excel-to-HTA chain) are cited by the source article but were not independently retrieved.
MITRE ATT&CK techniques used in TL-2026-4643
Defense Evasion
T1027.013 Encrypted/Encoded File; T1127.001 MSBuild; T1140 Deobfuscate/Decode Files or Information; T1218.009 Regsvcs/Regasm; T1620 Reflective Code Loading
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1059.007 JavaScript; T1204.002 Malicious File
Discovery
T1082 System Information Discovery
Command and Control
T1095 Non-Application Layer Protocol; T1573.001 Symmetric Cryptography
Initial Access
Affected products and versions in XWorm .NET Loader (RSG_UnityApp) Reused Across
- Microsoft — Windows (endpoints with .NET Framework utilities MSBuild.exe / RegAsm.exe)
Vulnerable versions: Not version-specific; social-engineering delivery
Remediation for XWorm .NET Loader (RSG_UnityApp) Reused Across
Immediate actions
- Block the listed C2 domains, IPs and ports (4521, 3008, 1177) at egress and hunt historical connections
- Quarantine emails with .vbs/.js attachments and Spanish judicial-themed lures
- Hunt for RegAsm.exe or MSBuild.exe spawned by powershell.exe, wscript.exe or cscript.exe, and for those processes making outbound network connections
Workarounds
- Change default file association of .vbs/.js/.vbe/.jse to a text editor
- Block dynamic DNS domains (duckdns.org, webredirect.org) where there is no business need
Longer-term hardening
- Block or prompt-restrict wscript.exe/cscript.exe execution of script attachments from email and downloads
- Enable PowerShell Script Block and Module logging and AMSI-capable EDR to catch reflective .NET assembly loading
- Restrict MSBuild.exe and RegAsm.exe execution on endpoints that do not need them via application control
Timeline of XWorm .NET Loader (RSG_UnityApp) Reused Across
- Cyber Security News reports a related XWorm v5.6 campaign against Brazilian/LATAM businesses (fake bank receipts as .pdf.js droppers, PowerShell in-memory .NET loading, injection into CasPol.exe, AES-ECB with MD5-derived keys), illustrating the same script-to-reflective-loader pattern
- UK-linked XWorm case documented by Buschbeck (per source article) using a .NET loader later found binary-identical to the Colombian campaign loader
- Cyber Security News reports a related Colombian judicial-notification phishing campaign (AsyncRAT delivery, separate payload) showing the same lure theme
- Three of four listed C2 endpoints noted in public sandbox records with various builds, mutexes and group values; XWorm config decryption (AES-256-ECB keyed by MD5 of mutex) described
- Source article cites Arctic Wolf (XWorm configuration decryption tooling, wolf-tools), Buschbeck (September report with identical DLL hash and JavaScript delivery variant) and Fortinet (parallel Excel-to-HTA chain delivering XWorm via MSBuild.exe); these were not independently retrieved
- Loader assessed as binary-identical between Colombian and UK-linked cases; payload hashes, execution targets and C2 configurations differ, so reuse does not imply common attribution
- GBHackers publishes analysis of Spanish-language judicial-themed phishing delivering XWorm/DCRat via RSG_UnityApp 1.1.0.0 loader, executing in RegAsm.exe/MSBuild.exe
Sources cited for XWorm .NET Loader (RSG_UnityApp) Reused Across
- Hackers Reuse XWorm Malware Loader Across Phishing Campaigns Targeting Colombia and the UK
- Hackers Leverage Judicial Notifications (Colombia, related judicial-themed campaign delivering AsyncRAT)
- Shadow Vector targets Colombian users via privilege escalation and court-themed SVG decoys
- XWorm's Shape-Shifting Arsenal: Loader and Stager Variants in the Wild
- Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails
- IBM X-Force Threat Analysis: DCRat presence growing in Latin America
- XWorm Malware Uses Fake Financial Receipts to Target Brazilian and LATAM Businesses
- XWorm malware communication analysis (ANY.RUN)
- XWORM Returns to Haunt Systems with Ghost Crypt (Kroll)
- XWorm DeepDive
Detection coverage for TL-2026-4643
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4643 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4643
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.