{
  "id": 19356246,
  "title": "Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America",
  "url": "https://urgent.news/2026/11/10/blind-eagle-uses-fake-court-notices-to-deliver-remote-access-trojan",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T15:58:44.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html"
  },
  "original_language": "en",
  "account": "Blind Eagle, a Spanish-speaking threat actor, has launched a new phishing campaign targeting Latin American organizations. The group has been active since 2018 and has previously used spear-phishing to distribute RATs such as AsyncRAT, BitRAT, and NjRAT. This campaign involves sending emails with court-related themes, such as judicial notices, fiscalía notices, and administrative documents, to trick recipients into opening malware-laden attachments. One identified weapon is a Colombian judicial-themed SVG image that renders a fraudulent web page, which uses HTML smuggling to deliver a ZIP archive containing a JavaScript dropper and a Visual Basic Script. The malware conducts reconnaissance, collects system information, and establishes persistence on the host. The final payload is an AsyncRAT fork with DCRat lineage, which could lead to environment reconnaissance, document collection, remote access, and data exfiltration. The attack targets judicial, fiscal, administrative, and educational organizations, potentially exposing sensitive legal, financial, and institutional information.",
  "summary": "The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat. \"The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and",
  "key_points": [
    "Blind Eagle Spanish-speaking threat actor targets Latin America since 2018",
    "Phishing campaign uses court-related themes to deliver malware",
    "Final payload is AsyncRAT fork with DCRat lineage for data exfiltration"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}