Operation Covert Access: Rust RAT Infiltrates Argentina’s Judiciary

Operation Covert Access: Rust RAT Infiltrates Argentina’s Judiciary has been uncovered by researchers who describe a stealthy, Rust-based Remote Access Trojan used to infiltrate Argentina’s legal system. According to Seqrite Labs, spear-phishing emails carry a ZIP archive with a legitimate‑looking decoy document that imitates a federal court ruling, designed to fool legal professionals.

The infection chain begins when a user opens a malicious LNK file disguised as a PDF, triggering a hidden PowerShell command that downloads the next stage from a GitHub repository. The core malware renames itself to msedge_proxy.exe and hides in the Microsoft Edge user data directory, while performing checks for virtualisation and analysis tools and terminating if such environments are detected.

It features a modular command set to maintain persistence, harvest files, elevate privileges, and even perform encryption, with C2 commands like _ENCRYPT_:_DECRYPT_ that facilitate decrypting a supplied DLL. The report concludes that judicial-themed spear‑phishing, weaponised LNK files, and a covert Rust RAT can establish long‑term access within high‑trust institutions. 21 January 2026.