EN PT-BR
← Voltar ao feed
high

XWorm .NET loader reused in judicial-themed phishing against Colombia, binary-identical to a UK-linked case

1 fonte(s) · 1 atualização(ões) · publicado 28/10/2026 09:51 · coletado há 4 dias

A judicial-themed phishing campaign targeting Colombian organizations delivers XWorm through obfuscated VBScript/JavaScript attachments, encrypted PowerShell and a reusable .NET loader. The recovered loader (RSG_UnityApp) is binary-identical to one documented in a September 10, 2026 UK-linked case reported by Buschbeck. The overlap shows loader reuse, not common attribution: payload hashes, process targets and C2 infrastructure differ. Three recovered C2 endpoints also appear in public sandbox records tied to other XWorm builds. Another tracked sample delivers DCRat through the same loader.

Detalhes técnicos

  • Spanish-language emails sent from Colombian organizations carried VBScript and JavaScript attachments named like administrative or judicial correspondence.
  • The VBScript layers use generated identifiers, encrypted string concatenation, custom Base93 decoding, custom 8-byte and 12-byte block ciphers (CBC-like chaining) and an AES-256-CBC layer that recovers PowerShell. The JavaScript variants hide PowerShell through encoded strings and dynamically built function names.
  • The PowerShell unpacker uses custom Base52 encoding, keyed 256-entry substitution tables, .NET System.Random determinism and an RC4-inspired stream generator, ending in a PE32 .NET DLL and a VB.NET executable.
  • PowerShell reflectively loads the DLL RSG_UnityApp (version 1.1.0.0, Crypto Obfuscator protected) and calls a public static method with six arguments, including the RegAsm.exe path and the XWorm payload bytes. The September UK case used JavaScript delivery and MSBuild.exe as the target.
  • Arctic Wolf found that the XWorm config decryptor derives its key from the MD5 of the mutex string and applies AES-256-ECB to Base64 values. Other variants used SM4-CBC plus Square-CBC.
  • C2 traffic uses AES-128-ECB with a decimal length prefix and NUL separator and the <XWormmm> delimiter. The INFO beacon discloses user, OS, elevation, webcam, hardware and antivirus data. Commands include update, DW, FM, LN, RunShell, $Cap, plugin, savePlugin and StartDDos, and plugins load as managed assemblies.
  • Fortinet separately reported an Excel-to-HTA chain running XWorm in MSBuild.exe, a similar architecture with no established link.

Remediação

The article gives no explicit remediation. Defenders should track loader identity, payload configuration and infrastructure as separate analytic elements, and hunt for script attachments spawning PowerShell that loads .NET assemblies into RegAsm.exe or MSBuild.exe.

Linha do tempo

  1. gbhackers.com ↗ · pub. 28/10/2026 09:51 · coletado 28/10 10:00 primeiro registro

    XWorm .NET loader reused in judicial-themed phishing against Colombia, binary-identical to a UK-linked case

    ler a análise desta fonte

    A judicial-themed phishing campaign targeting Colombian organizations delivers XWorm through obfuscated VBScript/JavaScript attachments, encrypted PowerShell and a reusable .NET loader. The recovered loader (RSG_UnityApp) is binary-identical to one documented in a September 10, 2026 UK-linked case reported by Buschbeck. The overlap shows loader reuse, not common attribution: payload hashes, process targets and C2 infrastructure differ. Three recovered C2 endpoints also appear in public sandbox records tied to other XWorm builds. Another tracked sample delivers DCRat through the same loader.

    Technical Details

    • Spanish-language emails sent from Colombian organizations carried VBScript and JavaScript attachments named like administrative or judicial correspondence.
    • The VBScript layers use generated identifiers, encrypted string concatenation, custom Base93 decoding, custom 8-byte and 12-byte block ciphers (CBC-like chaining) and an AES-256-CBC layer that recovers PowerShell. The JavaScript variants hide PowerShell through encoded strings and dynamically built function names.
    • The PowerShell unpacker uses custom Base52 encoding, keyed 256-entry substitution tables, .NET System.Random determinism and an RC4-inspired stream generator, ending in a PE32 .NET DLL and a VB.NET executable.
    • PowerShell reflectively loads the DLL RSG_UnityApp (version 1.1.0.0, Crypto Obfuscator protected) and calls a public static method with six arguments, including the RegAsm.exe path and the XWorm payload bytes. The September UK case used JavaScript delivery and MSBuild.exe as the target.
    • Arctic Wolf found that the XWorm config decryptor derives its key from the MD5 of the mutex string and applies AES-256-ECB to Base64 values. Other variants used SM4-CBC plus Square-CBC.
    • C2 traffic uses AES-128-ECB with a decimal length prefix and NUL separator and the <XWormmm> delimiter. The INFO beacon discloses user, OS, elevation, webcam, hardware and antivirus data. Commands include update, DW, FM, LN, RunShell, $Cap, plugin, savePlugin and StartDDos, and plugins load as managed assemblies.
    • Fortinet separately reported an Excel-to-HTA chain running XWorm in MSBuild.exe, a similar architecture with no established link.

    Remediation

    The article gives no explicit remediation. Defenders should track loader identity, payload configuration and infrastructure as separate analytic elements, and hunt for script attachments spawning PowerShell that loads .NET assemblies into RegAsm.exe or MSBuild.exe.