ColCERT warns of fake court emails in Colombia

ColCERT, the cyber emergency response team of Colombia’s Ministry of ICT, issued alert COLCERT AL-20261105-128, rated high severity, over an active campaign impersonating subpoenas, lawsuits and court notices sent to public agencies and Colombian companies. The messages aim to get victims to open malicious files or follow download links, and the files may use .js or .vbs extensions while appearing to be PDF documents.

What did ColCERT detect?

The advisory describes emails that mimic judicial communications to push recipients into opening files or accessing downloads. According to the alert, the lure relies on fake subpoenas, lawsuits and notices, a setup designed to lower the recipient’s guard and trigger the attached or linked content.

The publication identifies Colombian public entities and companies as the campaign’s targets. It does not provide confirmed numbers of affected organizations or mention an associated CVE.

What kind of files are being used?

The files can look like PDF documents, but they actually use .js or .vbs extensions. That detail matters because it hides the file’s real nature behind a format users are more likely to trust when it arrives by email.

Independent coverage added that the campaign was distributing XWorm 7.2 on Windows systems. That same coverage said the malware could inject itself into legitimate processes to reduce its exposure on disk, a technique that makes it harder to detect because part of its activity blends in with valid system processes.

What is the scope of the warning?

The available material points to an active campaign aimed at Colombia’s corporate and government environment, but it does not describe a victim count or a quantified impact. It also does not identify a public exploit, a specific vulnerability or a CVE, so the alert focuses on email impersonation and the malicious file as the main delivery vector.

The first reference comes from a Más Colombia note published on November 5, 2026. The mention of XWorm 7.2 appears in an independent report dated November 9, 2026, which is also cited in the provided material.