Fake court summonses are landing in the inboxes of Colombian organizations, and opening the attached "notification" hands the sender a remote access trojan. Colombia's national CERT, colCERT, issued alert AL-128 on 5 November, rating the campaign HIGH and warning public and private entities that it is active.
The alert builds on research by Arctic Wolf Labs' Adversary Research team, published on 26 October, which traced the emails to XWorm, a commodity RAT that steals credentials, logs keystrokes, pulls down extra modules and spreads over USB drives.
Lures that look like a tutela notice
The emails are written in Spanish and impersonate judicial institutions, with summonses, lawsuits and disciplinary notices urging prompt attention. Arctic Wolf says the observed emails originated from Colombian organizations. Attachment names mimic real legal paperwork, such as ACTA_NOTIFICA_TUTELA.js and PROCESO DISCIPLINARIO_RAD_00470032.vbs (a tutela is a Colombian constitutional rights claim). Some messages instead link to files hosted on legitimate services, Filestack and ImageKit, which helps them slip past email filters.
The attachments are scripts, not documents. Running one launches heavily obfuscated PowerShell that, according to Arctic Wolf, peels away several custom encryption layers before loading a .NET DLL called RSG_UnityApp directly into memory. That loader starts a legitimate Windows binary, RegAsm.exe or MSBuild.exe, in a suspended state and swaps XWorm into it (a technique known as process hollowing), so the RAT runs under a trusted process name and never lands on disk as itself.
The same loader turned up in a UK case
The most telling finding is about the loader, not the RAT. Arctic Wolf found the RSG_UnityApp DLL is binary-identical to one documented by researcher Buschbeck in a 10 September analysis of a UK-targeting XWorm chain that used a JavaScript first stage, MSBuild.exe and different C2 servers. Arctic Wolf adds that a separate sample it's tracking delivers DCRat through the same loader. colCERT reads the reuse as a sign the operator is using a commercial crypter or loader rather than building its own.
Colombia has seen this shape of attack before. We covered fake compliance requests delivering XWorm in October, and Blind Eagle has used fake court notices against Colombian officials. Neither colCERT nor Arctic Wolf attributes this campaign to a named group. More context is on our Colombia profile.
Make .vbs and .js files open in Notepad
colCERT's recommendations are practical and cheap:
- Use Group Policy to change the default handler for .vbs and .js files to a plain text editor, so a double-click shows the script instead of running it.
- Alert when wscript.exe, cscript.exe or powershell.exe spawns RegAsm.exe or MSBuild.exe, especially with outbound network connections.
- Run PowerShell in Constrained Language Mode and enable Script Block Logging (Event ID 4104).
- Restrict or block Filestack and ImageKit where there is no business need.
- Train staff to verify any summons through the court's official portal before opening attachments.
Indicators of compromise
- C2: loganwolverin2042[.]webredirect[.]org (TCP 4521), ukranieukranie20222022[.]duckdns[.]org (TCP 3008), 45[.]92[.]1[.]127 (TCP 1177), 77[.]110[.]114[.]115 (TCP 3008)
- Second-stage downloads: hxxps://cdn[.]filestackcontent[.]com/B7hA66RuGnT1LRjBp2Ax, hxxps://ik[.]imagekit[.]io/randiatmv9/NOTIFICA_ACTO_PROCESO_TUTELA_PDF[.]zip
- RSG_UnityApp loader (SHA-256): fe34be2cee9ba40f0e6ce4dc509ba85b79851ca9d08bf8a878602300486674e2
- XWorm payload (SHA-256): ea0832705c8f8c368f4d4fb9eb15ddd64df1859e12af19a2e9b13280b2139bbe
Both reports publish the full hash list. The judicial lure is only the wrapper: the same bought loader can carry whatever payload its buyer picks next, so detections should key on the script-to-RegAsm process chain rather than on XWorm alone.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.