Colombia's national cyber emergency team COLCERT is warning of an active phishing campaign that uses fake court notices to install a remote access trojan on victims' machines. The alert, numbered AL-20260803-105 and marked TLP:CLEAR, rates the risk high.
The lure is a notificacion judicial, a judicial notification. Colombia's courts and the Fiscalia General de la Nacion now serve most of their notices electronically, so a message claiming there is a legal filing against the recipient carries real weight, particularly with the administrative and legal staff this campaign appears aimed at. COLCERT describes the pretext as highly effective and a repeat vector against the public sector.
How the attack works
Victims are steered to a phishing domain, wind2365[.]juridico[.]bond, which serves a ZIP archive containing a VBScript file following the pattern NOTIFICACION JUDICIAL_BEB428_.vbs. Running it starts a chain of PowerShell scripts that compile .NET assemblies directly in memory, which keeps the payload off disk where a scanner would see it. Persistence comes from a scheduled task disguised as WindowsUpdate plus a registry startup key.
The final payload is VJW0rm, short for Vengeance Justice Worm, a modular open source trojan documented since 2016 and credited to a developer using the handle v_B01 on the DevPoint forum. COLCERT assesses with high confidence that this is the family involved, on the basis that the implant checks in over HTTP to the path /Vre, a pattern distinctive enough that a VJW0rm specific Suricata signature matched the traffic. The command server, c2nuevpoder[.]kozow[.]com on port 7575, sits on a free dynamic DNS provider.
What the malware can do
VJW0rm is a hybrid, part worm and part remote access trojan. Its documented capabilities include stealing credentials, running commands sent by the operator, logging keystrokes, capturing video and copying itself onto removable media, which is how it moves further inside an organisation without any second phishing email. COLCERT notes that threat intelligence frequently records VJW0rm as an initial stager for heavier families such as AsyncRAT or FormBook, although no secondary payload ran in the sample it contained.
Colombia has been under steady pressure from commodity trojans delivered exactly this way. The alert lands days after COLCERT linked a Remcos spyware case to the Blind Eagle group, another operation built on Spanish language social engineering rather than novel tooling. Our Colombia country profile tracks the wider picture.
What you should do
Block the phishing domain and the command server, then hunt for a scheduled task named WindowsUpdate that does not belong to Windows Update, along with run keys pointing at wscript or PowerShell. Because the first stage is a .vbs inside a ZIP, disabling the Windows Script Host for ordinary users stops the chain before it starts, and it is worth telling staff plainly that a genuine judicial notification in Colombia never arrives as a script in an archive.
Indicators from the alert, defanged: phishing domain wind2365[.]juridico[.]bond, command and control endpoint c2nuevpoder[.]kozow[.]com:7575/Vre, dropper filename pattern NOTIFICACION JUDICIAL_BEB428_.vbs, scheduled task named WindowsUpdate.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.