Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat. "The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and
Blind Eagle, a Spanish-speaking threat actor, has launched a new phishing campaign targeting Latin American organizations. The group has been active since 2018 and has previously used spear-phishing to distribute RATs such as AsyncRAT, BitRAT, and NjRAT. This campaign involves sending emails with court-related themes, such as judicial notices, fiscalía notices, and administrative documents, to trick recipients into opening malware-laden attachments.
One identified weapon is a Colombian judicial-themed SVG image that renders a fraudulent web page, which uses HTML smuggling to deliver a ZIP archive containing a JavaScript dropper and a Visual Basic Script. The malware conducts reconnaissance, collects system information, and establishes persistence on the host. The final payload is an AsyncRAT fork with DCRat lineage, which could lead to environment reconnaissance, document collection, remote access, and data exfiltration.
The attack targets judicial, fiscal, administrative, and educational organizations, potentially exposing sensitive legal, financial, and institutional information.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
