Fake Federal Court Notices Target 100,000+ Companies With LodaRAT Malware Campaign

Security researchers have uncovered a large-scale phishing campaign impersonating the United States District Court for the Southern District of Florida, using fake Alternative Dispute Resolution (ADR) notices to distribute the LodaRAT remote access trojan. Researchers estimate that more than 100,000 companies may be targeted through personalized phishing emails and counterfeit legal portals.

The campaign begins with emails claiming recipients are involved in a court-ordered ADR case. Each message contains a unique ADR identifier and directs victims to a fraudulent court website designed to appear legitimate. The site displays company-specific details and invites users to download what appears to be a case file. Victims instead receive a password-protected archive containing malware disguised as court-related documents.

Researchers found three separate delivery mechanisms within the downloaded package: a Microsoft Management Console file, a batch script, and a Windows shortcut file. Although presented differently, each ultimately downloads and executes the same LodaRAT payload under different filenames, including SystemSettings.exe, Taskmgr.exe, and msedge.exe. The malware is retrieved from attacker-controlled infrastructure and immediately established on the victim system.

LodaRAT is a fully featured remote access trojan capable of credential theft, surveillance, remote control, persistence, and lateral movement. The malware can extract passwords and cookies from Chromium-based browsers, steal Firefox credentials, collect Wi-Fi keys, capture keystrokes, screenshots, webcam feeds, and microphone recordings, and execute commands remotely. Researchers also observed capabilities for SOCKS proxying, RDP enablement, ngrok tunneling, USB propagation, and network spreading across internal environments.

The attackers invested heavily in the social engineering component of the campaign. The fake portal contains realistic court language, searchable case records, and individualized content designed to convince targets that the matter is legitimate. Investigators believe the operation uses compromised or repurposed infrastructure, including a decades-old domain and a bulk-email platform used to distribute phishing messages.

The campaign’s command-and-control infrastructure and malware variants share identical functionality despite using different filenames and persistence mechanisms, indicating they were generated from a common builder or operated by the same threat actor. Researchers identified a single LodaRAT operation behind all observed variants.

Organizations are urged to educate employees about phishing attempts involving legal notices, verify any court-related communications through official government sources, and closely monitor systems for suspicious downloads or unexpected remote-access activity. Additional technical analysis and indicators of compromise are available in the original ThreatDown research: Fake court ADR phishing campaign distributes LodaRAT | ThreatDown.