Blind Eagle Uses Fake Court Notices to Target Latin America

A new campaign from the threat actor known as Blind Eagle, also referred to as APT-C-36, has re-emerged targeting Latin American organisations with phishing lures themed around judicial and administrative notices. The campaign, observed in Portuguese and Spanish, uses documents such as court notifications, fiscalía notices and tutela proceedings to deliver a remote access trojan (RAT) that appears to descend from AsyncRAT and DCRat lineage.

Zenox described the operation as Spanish-speaking and active since 2018, with Blind Eagle commonly employing spear-phishing to spread a range of commodity RATs including AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT and Remcos RAT. Evidence cited includes a Colombian judicial-themed XHTML attachment that renders a counterfeit page impersonating the Fiscalía General de la Nación.

Technical details noted by investigators include HTML smuggling to assemble a ZIP payload locally in the browser using ZipCrypto, bypassing email security controls. The ZIP contains a JavaScript dropper masquerading as Network Configuration Auditor version 2.7.298, which conducts environment reconnaissance and gathers system and localisation data in Portuguese and Spanish before launching a Visual Basic Script to bypass AMSI and ETW.

The dropper then deletes the original XHTML artefact, clears MotW metadata, and establishes persistence via the Windows Startup folder. PowerShell is used to decode and deploy the final RAT payload in memory. While there is no evidence of successful real-world compromises to date, a breach could enable reconnaissance, document collection, remote access, keystroke and screen capture, surveillance and encrypted data exfiltration.

The operation is described as an APT-C-36 activity conducted from a Brazilian operational cluster, targeting judicial, fiscal, administrative and educational organisations.