[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7z-3GLOoEwztEpO3UDqrQcc-ZR64N1rHFuAHu9aO6vw":3},{"article":4,"iocs":41,"watch_terms":48,"solutions":49,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"3cf3aebc-ad70-4e4f-a566-9768a83720e3","Hackers Use Fake Court Notices to Deliver XWorm Malware Through Hidden Windows Scripts","hackers-use-fake-court-notices-to-deliver-xworm-malware-through-hidden-windows-s-26422c","Attackers are sending fake court notices to organizations in Colombia and using them to install XWorm, a remote access tool that gives criminals full control of an infected PC. The emails look like real legal letters. The attached files are hidden Windows scripts that quietly start the infection. The lure works because few people ignore […] The post Hackers Use Fake Court Notices to Deliver XWorm Malware Through Hidden Windows Scripts appeared first on Cyber Security News.","Attackers are targeting organizations in Colombia with sophisticated phishing emails disguised as court notices. These emails contain hidden Windows scripts that, once executed, deploy the XWorm remote access tool, granting attackers full control over infected systems. The campaign reuses infrastructure and techniques seen in previous XWorm and DCRat attacks, highlighting the adaptability of threat actors.","Hackers use fake court notices to deliver XWorm malware via hidden Windows scripts.","https:\u002F\u002Fcybersecuritynews.com\u002Fxworm-malware-3\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FHackers-Use-Fake-Court-Notices-to-Deliver-XWorm-Malware-Through-Hidden-Windows-Scripts.webp","2026-10-28T13:07:09+00:00","2026-10-28T14:00:09.227015+00:00",8,[17,20],{"name":18,"type":19},"Blind Eagle","threat_actor",{"name":21,"type":22},"Arctic Wolf Labs","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,45],{"type":27,"value":43,"context":44},"XWorm","Remote Access Tool (RAT) used in the attack.",{"type":27,"value":46,"context":47},"DCRat","Another malware delivered by the same loader.",[21],{"controls":50,"vendors":135},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":81,"name":82,"problem":83,"products":84},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":110,"name":111,"problem":112,"products":113},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[114,122,129],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":126,"url":127,"description":128},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":131,"url":133,"description":134},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[136],{"slug":137,"name":138,"logo_path":139,"roles":140},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"fake-court-notices-deliver-xworm-rat-via-hidden-windows-scripts","Fake Court Notices Deliver XWorm RAT via Hidden Windows Scripts","Attackers are exploiting human trust by disguising malware delivery as legitimate court correspondence, a classic social engineering technique that bypasses technical controls by targeting user behavior. Once a victim executes the hidden Windows script embedded in the phishing email, XWorm grants attackers full remote access to the infected system, enabling data theft, lateral movement, and further compromise. The reuse of infrastructure across multiple campaigns (XWorm and DCRat) indicates a persistent and adaptive threat actor that iterates on proven tactics. This matters because a single click from an untrained employee can result in complete organizational compromise, regardless of how robust perimeter defenses are.",[147,148,149,150,151,152,153],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":155,"MITRE ATT&CK T1566: Phishing":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":158,"CIS Control 17: Incident Response Management":159,"CIS Control 14: Security Awareness and Skills Training":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"NIS2 requires entities to implement incident handling and awareness measures; the use of deceptive court notices to deliver RATs is precisely the human-layer threat that NIS2's mandatory security awareness and incident response obligations are designed to address.","This attack is a textbook spearphishing campaign using fake court notices as lures to trick recipients into executing malicious Windows scripts, exactly the technique T1566 documents and for which it provides detection and mitigation guidance.","Deploying up-to-date endpoint protection and patched email filtering solutions capable of detecting hidden scripts is a remediation control that would reduce the attack surface exploited by this campaign.","This clause requires organizations to ensure staff have the competence to recognize security threats; employees who cannot identify a phishing email disguised as a court notice represent a direct gap in required security competence.","The reuse of infrastructure across multiple campaigns suggests victims may not have shared threat intelligence or had mature incident response processes to detect and report indicators that could have warned other organizations sooner.","The attack succeeded by exploiting employees' inability to recognize a social engineering lure; structured, role-based security awareness training on phishing recognition would directly reduce the likelihood of script execution.","Limiting which users and processes can execute scripting engines and enforcing least-privilege access would have constrained the damage XWorm could inflict after the initial script execution."]