The Latin American threat group known as Blind Eagle has resurfaced with an evasive spear-phishing campaign targeting administrative, legal, and educational institutions with counterfeit judicial notices designed to deploy an advanced remote access trojan (RAT).
Identified by cybersecurity firm Zenox, the operation leverages highly customized Spanish and Portuguese lures designed to impersonate official court notifications, fiscal notices, tutela proceedings, and government correspondence. Active since at least 2018 and also tracked as APT-C-36, the Spanish-speaking adversary has a long-standing history of using targeted email lures to deliver modular commodity trojans across South America.
The initial attack vectors rely on phishing emails sent to personnel handling institutional service requests, contracts, and case management. One examined email contained a weaponized XHTML attachment disguised as a Scalable Vector Graphics (SVG) document that displays a fraudulent portal mimicking Colombia's Office of the Attorney General (Fiscalía General de la Nación).
To bypass email scanning gateways, the bogus landing page uses HTML smuggling to construct a password-protected ZIP file directly inside the victim's browser using ZipCrypto. Extracted from this archive is an obfuscated JavaScript dropper disguised as "Network Configuration Auditor" version 2.7.298, which performs local reconnaissance by gathering host telemetry, network profiles, user language configurations, and directory paths.
Upon execution, the dropper triggers a Visual Basic Script that bypasses the Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) while presenting a decoy criminal citation page to deceive the victim. Simultaneously, the script scrubs the original delivery artifacts, removes Mark of the Web (MotW) identifiers, and establishes persistence within the Windows Startup directory.
The operation culminates with an in-memory PowerShell routine that decodes and launches the final RAT payload, which analysts identify as a customized AsyncRAT fork bearing structural and configuration lineage from DCRat. While active compromises have not been publicly confirmed, successful deployment grants attackers extensive surveillance capabilities, including keystroke logging, screen capture, document theft, and encrypted data exfiltration coordinated through an operational cluster in Brazil.
Make the description more conciseAdd a defender-focused sectionFormat the IOCs as a table
AllPeoplePeopleFilesFilesMeetingsMeetingsEmailsEmails
