Hackers Reuse XWorm Malware Loader Across Phishing Campaigns Targeting Colombia and the UK

A judicial-themed phishing campaign targeting Colombian organizations that delivers XWorm through obfuscated scripts, encrypted PowerShell, and a reusable .NET loader.

The recovered loader is binary-identical to one documented in a September 10, 2026, UK-linked case, connecting otherwise differently packaged delivery chains.

The overlap establishes loader reuse, not common attribution. Different payload hashes, execution targets, and command-and-control infrastructure distinguish the cases.

Separately, three recovered C2 endpoints appear in public XWorm sandbox records associated with other builds, extending the evidence of infrastructure reuse.

The Colombian emails originated from Colombian organizations and used Spanish-language messages urging prompt attention.

Attached VBScript and JavaScript filenames imitated administrative or judicial correspondence, encouraging recipients to execute scripts disguised as documents.

The VBScript protection combined generated identifiers, misleading configuration variables, encrypted string concatenation, and an execution wrapper.

An inner layer implemented custom Base93 decoding, packing symbol pairs into 13- or 14-bit values according to a threshold-dependent rule.

Decoded content passed through keyed substitution and bit-manipulation routines. Custom eight-byte and 12-byte block transforms used table lookups, word mixing, XOR operations, and rotations or shifts.

The 12-byte construction chained blocks through XOR with previous ciphertext, resembling CBC around a nonstandard primitive. Another AES-256-CBC layer helped recover PowerShell.

XWorm Malware Loader

JavaScript variants concealed PowerShell through encoded strings, concatenation, and dynamically constructed function names.

Arctic Wolf identified that, XWorm’s configuration decryptor derived its key from the mutex string’s MD5 hash and applied AES-256-ECB to Base64-decoded values.

One combined SM4-CBC and Square-CBC encryption with keys recovered from XOR-obfuscated values. Another used integrity verification and encoded Unicode strings within a custom cryptographic container.

The PowerShell unpacker processed two protected strings with separate keys and initialization vectors. Its custom Base52 encoding represented seven bytes with ten characters in complete groups.

Keyed 256-entry substitution tables, deterministic .NET System.Random behavior, and an RC4-inspired stream generator ultimately exposed a PE32 .NET DLL and VB.NET executable.

PowerShell reflectively loaded the DLL, RSG_UnityApp, and invoked a public static method with six arguments, including the RegAsm.exe path and XWorm payload bytes.

The assembly identified itself as version 1.1.0.0 and carried Crypto Obfuscator protection.

Buschbeck’s September report documented the identical DLL hash and invocation structure, but used JavaScript delivery, MSBuild.exe as the configured process target, and different XWorm payload and C2 values.

Another sample under tracking delivers DCRat through the same loader.

The pattern parallels separately documented XWorm campaigns combining phishing, PowerShell, memory-loaded .NET components, and legitimate Microsoft executables.

Fortinet reported an Excel-to-HTA chain culminating in XWorm execution inside MSBuild.exe, demonstrating similar delivery architecture without establishing a direct campaign connection.

Network communications instead used AES-128-ECB, prefixing encrypted messages with their decimal byte length and a NUL separator.

Decrypted messages used the delimiter. Initial INFO beacons disclosed usernames, operating-system details, installation dates, elevation status, webcam availability, hardware specifications, and antivirus status.

Supported commands included update, DW, FM, LN, RunShell, $Cap, plugin, savePlugin, StartDDos, and host-file operations. Plugins could load as managed assemblies, expanding functionality.

Public sandbox records linked the three endpoints to samples carrying different hashes, mutexes, and group values. Those differences support reuse across separately configured builds rather than repeated sightings of one executable.

Together, the findings show why loader identity, payload configuration, and infrastructure must remain analytically distinct.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.