A recent campaign targets Colombian organizations with judicial-themed phishing emails designed to deliver the XWorm remote access trojan. The initial access vector relies on social engineering, using Spanish-language text that mimics legitimate administrative or judicial correspondence to urge prompt attention. The observed emails originate from Colombian entities, creating a localized threat environment. The risk is significant because the lure appears credible to recipients, increasing the likelihood of successful execution. The campaign utilizes a multistage delivery chain, with the initial payloads disguised as standard script files. This approach allows the threat actor to bypass initial scrutiny while establishing a foothold in the target environment. The scope is limited to the documented Colombian targeting, but the reuse of infrastructure suggests a broader operational reach.
The delivery mechanism begins with VBScript or JavaScript files that employ heavy obfuscation to conceal the PowerShell stage. The VBScript variant uses a custom Base93 decoder and nonstandard block transforms, while the JavaScript variant uses dynamic key derivation and custom cryptographic containers. Once decoded, the PowerShell unpacker yields a .NET DLL and a VB.NET executable. The DLL is loaded via reflection into a legitimate process, specifically the registration assembly tool, to perform reflective injection. This loader is binary-identical to one used in a separate UK-linked case, indicating cross-case reuse. The final XWorm payload communicates with three distinct command-and-control endpoints using AES-128-ECB encryption. The protocol includes a specific framing structure with decimal length prefixes and a NUL byte. The trojan collects system information, including hardware specs and antivirus status, and supports commands for remote shell access, file management, and DDoS initiation. Plugins can be loaded as managed assemblies to extend functionality.[/subscribe_to_unlock_form]
A recent campaign targets Colombian organizations with judicial-themed phishing emails designed to deliver the XWorm remote access trojan. The initial access vector relies on social engineering, using Spanish-language text that mimics legitimate administrative or judicial correspondence to urge prompt attention. The observed emails originate from Colombian entities, creating a localized threat environment. The risk is significant because the lure appears credible to recipients, increasing the likelihood of successful execution. The campaign utilizes a multistage delivery chain, with the initial payloads disguised as standard script files. This approach allows the threat actor to bypass initial scrutiny while establishing a foothold in the target environment. The scope is limited to the documented Colombian targeting, but the reuse of infrastructure suggests a broader operational reach.
The delivery mechanism begins with VBScript or JavaScript files that employ heavy obfuscation to conceal the PowerShell stage. The VBScript variant uses a custom Base93 decoder and nonstandard block transforms, while the JavaScript variant uses dynamic key derivation and custom cryptographic containers. Once decoded, the PowerShell unpacker yields a .NET DLL and a VB.NET executable. The DLL is loaded via reflection into a legitimate process, specifically the registration assembly tool, to perform reflective injection. This loader is binary-identical to one used in a separate UK-linked case, indicating cross-case reuse. The final XWorm payload communicates with three distinct command-and-control endpoints using AES-128-ECB encryption. The protocol includes a specific framing structure with decimal length prefixes and a NUL byte. The trojan collects system information, including hardware specs and antivirus status, and supports commands for remote shell access, file management, and DDoS initiation. Plugins can be loaded as managed assemblies to extend functionality.[emaillocker id="1283"]
The campaign demonstrates active development and infrastructure reuse, with the same command-and-control endpoints appearing in other public records under different sample hashes. This reuse supports the conclusion that the actor is operating multiple builds from a shared infrastructure base. The victim groups include judicial and administrative entities, suggesting a focus on high-value targets in the region. The consistent use of the same loader across different geographic targets indicates a modular approach to malware deployment. Defensively, organizations should monitor for anomalous script execution and reflective loading patterns. Network monitoring should focus on the specific framing structures and encrypted traffic patterns associated with this trojan. The reuse of infrastructure provides a stable indicator for detection and blocking efforts.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Execution | T1059.005 | Command and Scripting Interpreter | Visual Basic |
| Execution | T1059.007 | Command and Scripting Interpreter | JavaScript |
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Defense Evasion | T1027.010 | Obfuscated Files or Information | Command Obfuscation |
| Defense Evasion | T1027.013 | Obfuscated Files or Information | Encrypted/Encoded File |
| Defense Evasion | T1055.005 | Process Injection | Dynamic Code Loading |
| Defense Evasion | T1070.004 | Indicator Removal | File Deletion |
| Collection | T1056.001 | Input Capture | Keylogging |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Command and Control | T1573.002 | Encrypted Storage | Asymmetric Cryptography |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
The following reports contain further technical details:
[/emaillocker]