Arctic Wolf discovered a phishing campaign targeting Colombian organizations that uses legal notices to deliver XWorm, a remote access trojan. The attackers employ heavily protected scripts, PowerShell, and a reusable .NET loader to execute malicious code through the legitimate Windows RegAsm.exe process. The attachments mimic judicial notices, disciplinary proceedings, and official correspondence, making the delivery appear more credible to potential victims.
These files are crafted using either VBScript or JavaScript, both of which feature multiple obfuscation layers to obscure the PowerShell stage and complicate analysis. Additional routines involve substitution, bit manipulation, and custom block transformations before an AES-256-CBC layer helps recover PowerShell. One sample combines SM4-CBC and Square-CBC encryption, while another uses a custom container with integrity checks and encoded Unicode strings.
A custom Base52 decoder, keyed substitution tables, and an RC4-inspired routine ultimately recover a .NET DLL and a VB.NET executable. The earlier chain utilized JavaScript, targeting MSBuild.exe instead of RegAsm.exe, and delivered a different XWorm build with distinct command infrastructure. Decrypted messages employ the delimiter
Initial beacons provide usernames, operating systems, installation dates, privileges, webcam availability, hardware specifications, and antivirus status. Supported commands allow for shell execution, file management, screenshots, updates, plugin loading, denial-of-service activity, and hosts-file changes.
Investigators discovered shared infrastructure with public XWorm sandbox records, containing distinct hashes, mutexes, and group settings.
