{"id":4064,"date":"2026-11-10T17:18:27","date_gmt":"2026-11-10T17:18:27","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4064"},"modified":"2026-11-10T17:18:27","modified_gmt":"2026-11-10T17:18:27","slug":"blind-eagle-uses-fake-court-notices-to-deliver-remote-access-trojan-across-latin-america","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4064","title":{"rendered":"Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 10, 2026<\/span><\/span>Threat Intelligence \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The threat actor known as Blind Eagle<\/strong> has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.<\/p>\n

\u00abThe campaign uses Portuguese and Spanish lures that resemble court notifications, fiscal\u00eda notices, tutela proceedings<\/a>, and administrative documents,\u00bb Zenox said<\/a> in a report shared with The Hacker News.<\/p>\n

Assessed to be a Spanish-speaking group and active since 2018, Blind Eagle (aka APT-C-36) has a track record of using spear-phishing lures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.<\/p>\n

Attack chains begin with phishing emails targeting individuals who handle cases, contracts, judicial, or institutional service requests to trick them into opening a malware-laced attachment.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

One email containing a Colombian judicial-themed XHTML file has been identified as a weaponized<\/a> Scalable Vector Graphics (SVG<\/a>) image<\/a> that renders a bogus web page impersonating Colombia’s Fiscal\u00eda General de la Naci\u00f3n, also referred to as the Office of the Attorney General.<\/p>\n

The web page, for its part, employs a technique known as HTML smuggling to assemble the next-stage ZIP archive payload locally in the web browser using ZipCrypto, thereby circumventing email security controls.<\/p>\n

Present within the ZIP archive is a JavaScript dropper that masquerades as Network Configuration Auditor version 2.7.298. The JavaScript code conducts environment reconnaissance, and collects details such as system version, network profile, installation date, memory size, computer name, environment variables, and directories localized in Portuguese and Spanish.<\/p>\n

Upon execution, it launches a Visual Basic Script that performs Windows Antimalware Scan Interface (AMSI<\/a>) and Event Tracing for Windows (ETW<\/a>) bypass, while displaying a fake criminal-citation page as a distraction mechanism.<\/p>\n

In parallel, the malware also takes steps to delete the original XHTML artifact, clears Mark of the Web (MotW) metadata, and sets up persistence<\/a> on the host under the Windows Startup folder so that it’s automatically executed on system startup.<\/p>\n

The attack culminates with the use of PowerShell to decode and launch the final RAT payload in memory. The trojan is an AsyncRAT fork with DCRat lineage based on code structure, configuration, build characteristics, and observed behavior.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Although there is no evidence that these attacks have been successful against real-world targets, a successful compromise could result in environment reconnaissance, document collection, remote access, keystroke and screen capture, surveillance, and data exfiltration over an encrypted channel.<\/p>\n

\u00abThe targeting of judicial, fiscal, administrative and educational organizations gives the operation access to highly sensitive legal, financial and institutional information,\u00bb Zenox said.<\/p>\n

\u00abCombined with the Portuguese and Spanish lures, Brazilian infrastructure, operational timezone and regional victimology, these elements establish the campaign as an APT-C-36 operation conducted through a Brazilian operational cluster.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Nov 10, 2026Threat Intelligence \/ Malware The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing…<\/p>\n","protected":false},"author":1,"featured_media":4065,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[130,1018,1625,2388,529,2776,150,1017,4108,12,667],"class_list":["post-4064","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-access","tag-america","tag-blind","tag-court","tag-deliver","tag-eagle","tag-fake","tag-latin","tag-notices","tag-remote","tag-trojan"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4064"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4064\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/4065"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}