# XWorm .NET Loader (RSG_UnityApp) Reused Across Judicial-Themed Phishing Campaigns Targeting Colombia and the UK

> Spanish-language judicial-themed phishing emails delivered VBScript/JavaScript attachments that decode and run encrypted PowerShell, reflectively loading a .NET DLL (RSG_UnityApp 1.1.0.0) that runs XWorm inside RegAsm.exe (MSBuild.exe also reported). The loader is reported as binary-identical to one documented in a September 10, 2026 UK-linked case, indicating loader reuse rather than common attribution; DCRat was also delivered via the same loader.

- **Published:** 2026-10-28T13:07:36Z
- **Last reviewed:** 2026-10-28T13:28:51.303Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4643
- **ID:** TL-2026-4643
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Phishing emails written in Spanish impersonate judicial correspondence from Colombian organizations and carry VBScript and JavaScript attachments disguised as administrative documents. The scripts are protected with generated identifiers, misleading configuration variables and encrypted string concatenation, and use a custom Base93 decoder (symbol pairs packed into 13- or 14-bit values under a threshold-dependent rule). Further layers use keyed substitution and bit-manipulation block transforms (8-byte and 12-byte blocks with table lookups, word mixing and XOR, chained in a CBC-like construction), AES-256-CBC, and alternative SM4-CBC / Square-CBC combinations with XOR-obfuscated keys. The PowerShell unpacker uses Base52 encoding (seven bytes represented by ten characters) and an RC4-inspired stream generator.

PowerShell reflectively loads a .NET DLL, assembly name RSG_UnityApp version 1.1.0.0, protected with Crypto Obfuscator. It invokes a public static method with six arguments, including the path to RegAsm.exe, and the final payload (XWorm, or alternatively DCRat) executes inside a trusted .NET utility process (RegAsm.exe; MSBuild.exe also reported in the campaign summary).

The XWorm configuration is decrypted with AES-256-ECB using MD5(mutex) as key. Network traffic is TCP, with messages delimited by <XWormmm> and encrypted with AES-128-ECB, each prefixed with a decimal byte length and a NUL separator. The initial INFO beacon discloses username, OS details, install date, elevation status, webcam availability, hardware specifications and antivirus status. Supported commands include update, DW, FM, LN, RunShell, $Cap, plugin, savePlugin, StartDDos and host-file operations; managed-assembly plugins extend functionality.

The loader is reported as binary-identical to one documented in a UK-linked case dated September 10, 2026, while payload hashes, execution targets and C2 configurations differ. Three of the four C2 endpoints appear in public sandbox records with various builds, mutexes and group values. The source stresses that loader identity, payload configuration and infrastructure must be kept analytically distinct: loader reuse is not evidence of a common actor. No actor attribution, CVE or file hashes are given in the source. Severity is analyst-assigned. Arctic Wolf, Buschbeck and Fortinet (parallel Excel-to-HTA chain) are cited by the source article but were not independently retrieved.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1218.009 Regsvcs/Regasm
- T1127.001 MSBuild
- T1082 System Information Discovery
- T1095 Non-Application Layer Protocol
- T1573.001 Symmetric Cryptography
- T1059.003 Windows Command Shell
- T1055.012 Process Hollowing
- T1027 Obfuscated Files or Information
- T1518.001 Security Software Discovery
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1568 Dynamic Resolution
- T1113 Screen Capture
- T1498 Network Denial of Service

## Sources

- [Hackers Reuse XWorm Malware Loader Across Phishing Campaigns Targeting Colombia and the UK](https://gbhackers.com/xworm-malware-loader/)
- [Hackers Leverage Judicial Notifications (Colombia, related judicial-themed campaign delivering AsyncRAT)](https://cybersecuritynews.com/hackers-leverage-judicial-notifications/)
- [Shadow Vector targets Colombian users via privilege escalation and court-themed SVG decoys](https://www.acronis.com/en-us/tru/posts/shadow-vector-targets-colombian-users-via-privilege-escalation-and-court-themed-svg-decoys/)
- [XWorm's Shape-Shifting Arsenal: Loader and Stager Variants in the Wild](https://www.splunk.com/en_us/blog/security/xworm-shape-shifting-arsenal-detection-evasion.html)
- [Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails](https://socprime.com/active-threats/xworm-campaign-utilizing-multiple-themed-phishing-emails/)
- [IBM X-Force Threat Analysis: DCRat presence growing in Latin America](https://www.ibm.com/think/x-force/dcrat-presence-growing-in-latin-america)
- [XWorm Malware Uses Fake Financial Receipts to Target Brazilian and LATAM Businesses](https://cybersecuritynews.com/xworm-malware-fake-financial-receipts/)
- [XWorm malware communication analysis (ANY.RUN)](https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/)
- [XWORM Returns to Haunt Systems with Ghost Crypt (Kroll)](https://www.kroll.com/en/publications/cyber/xworm-returns-haunt-systems-ghost-crypt)
- [XWorm DeepDive](https://redskyalliance.org/xindustry/xworm-deepdive)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4643