Colombia phishing uses fake court notices

A phishing campaign targeting organizations in Colombia is using fake court notices in Spanish to deliver the XWorm remote access trojan. The messages include JavaScript or VBScript attachments, sometimes inside ZIP files, and download additional stages from public file hosting services. The infection chain ends with obfuscated scripts, PowerShell, a .NET loader identified as RSG_UnityApp, and the execution of XWorm through RegAsm.exe.

How does the infection start?

The infection begins with messages impersonating court notifications and carrying malicious attachments. According to Cybersecurity News and Mallory, those attachments can be JavaScript or VBScript, and in some cases they arrive packaged in ZIP files. The scripts then fetch more stages from public file hosting services.

That mechanism helps hide part of the initial flow and keep the execution chain alive. The obfuscated scripts launch PowerShell, which in turn loads RSG_UnityApp, a .NET loader seen in these campaigns. From there, the sequence ends with XWorm, executed through RegAsm.exe, a legitimate Windows utility.

What is known about the RSG_UnityApp loader?

RSG_UnityApp appears to be the intermediate component that moves the attack from the initial lure to the final malware payload. Mallory describes it as a .NET loader used in phishing campaigns against Colombian organizations with judicial and administrative lures in Spanish. The entry also says that no identified threat actor has been tied to these deployments yet.

Mallory’s entry also notes that the same loader has been seen delivering DCRat. It also records the loader being reused in another XWorm case linked to the United Kingdom. That suggests the component is not exclusive to a single operation, although attribution remains unresolved for this campaign in Colombia.