Loading malware…
RSG_UnityApp is a .NET malware loader for Windows used to execute remote access trojans through process injection. A PowerShell stage unpacks the loader and an XWorm payload, loads the DLL, and supplies it with the payload code and the location of a legitimate Windows .NET assembly registration utility. RSG_UnityApp then injects XWorm into that trusted process, concealing payload execution within a legitimate application. The loader has also been observed delivering DCRat.
RSG_UnityApp has been used in phishing campaigns targeting Colombian organizations with Spanish-language court notices and legal or administrative lures. Malicious JavaScript or VBScript attachments, sometimes distributed in ZIP archives, retrieve additional stages from public file-hosting services. These obfuscated scripts launch the PowerShell stage that loads RSG_UnityApp. Loader reuse has also been observed in a separate XWorm case linked to the United Kingdom, but no named threat actor has been established for these deployments. Remote-control and information-collection functions belong to the delivered payloads rather than demonstrated capabilities of the loader itself.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.