Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.
“The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalÃa notices, tutela proceedings, and administrative documents,” Zenox said in a report shared with The Hacker News.
Assessed to be a Spanish-speaking group and active since 2018, Blind Eagle (aka APT-C-36) has a track record of using spear-phishing lures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.
Attack chains begin with phishing emails targeting individuals who handle cases, contracts, judicial, or institutional service requests to trick them into opening a malware-laced attachment.
One email containing a Colombian judicial-themed XHTML file has been identified as a weaponized Scalable Vector Graphics (SVG) image that renders a bogus web page impersonating Colombia’s FiscalÃa General de la Nación, also referred to as the Office of the Attorney General.
The web page, for its part, employs a technique known as HTML smuggling to assemble the next-stage ZIP archive payload locally in the web browser using ZipCrypto, thereby circumventing email security controls.
Present within the ZIP archive is a JavaScript dropper that masquerades as Network Configuration Auditor version 2.7.298. The JavaScript code conducts environment reconnaissance, and collects details such as system version, network profile, installation date, memory size, computer name, environment variables, and directories localized in Portuguese and Spanish.
Upon execution, it launches a Visual Basic Script that performs Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypass, while displaying a fake criminal-citation page as a distraction mechanism.
In parallel, the malware also takes steps to delete the original XHTML artifact, clears Mark of the Web (MotW) metadata, and sets up persistence on the host under the Windows Startup folder so that it’s automatically executed on system startup.
The attack culminates with the use of PowerShell to decode and launch the final RAT payload in memory. The trojan is an AsyncRAT fork with DCRat lineage based on code structure, configuration, build characteristics, and observed behavior.
“The targeting of judicial, fiscal, administrative and educational organizations gives the operation access to highly sensitive legal, financial and institutional information,” Zenox said.
“Combined with the Portuguese and Spanish lures, Brazilian infrastructure, operational timezone and regional victimology, these elements establish the campaign as an APT-C-36 operation conducted through a Brazilian operational cluster.”
Zenox told The Hacker News that it could not confirm whether any of these attacks had succeeded against real-world targets. However, during the campaign period between late October and early November 2026, it observed a large-scale wave of targeted phishing involving nearly 3,300 malicious emails.
While not all of these messages targeted organizations in Colombia, the country continues to remain a priority target for Blind Eagle for a combination of reasons.
“The repeated targeting of Colombia likely reflects multiple factors, with one of the main enabling factors being the structural vulnerabilities and uneven security maturity across parts of the country’s critical, public, financial, and private-sector infrastructure,” Zenox security researcher Gabriel Alves said.
“These conditions may increase the likelihood of successful compromises and offer greater opportunities to monetize access, steal sensitive data or funds, or reuse compromised credentials against critical systems. This is further supported by regional actors’ familiarity with the Colombian context and is consistent with patterns observed among Latin American threat actors.”
(The story was updated after publication to include additional insights from Zenox.)
About Author
