Blind Eagle phishing uses fake court notices to deliver a RAT
Original title: Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
Zenox reports no confirmed successful infections; the in-memory payload is an AsyncRAT fork with DCRat lineage.
Zenox says Blind Eagle, also known as APT-C-36, is phishing organizations in Latin America with Portuguese and Spanish court and administrative lures. An XHTML attachment smuggles a ZIP that drops JavaScript, which launches Visual Basic to bypass AMSI and ETW before PowerShell runs the RAT in memory. Persistence is set in the Windows Startup folder. Zenox reports no evidence the attacks succeeded against real targets.
Unconfirmed: Zenox reports no evidence of successful compromise, and the Brazilian-cluster attribution is its assessment.
- One lure impersonates Colombia's Fiscalía General de la Nación.
- The JavaScript dropper poses as Network Configuration Auditor version 2.7.298.
- HTML smuggling builds the ZIP in the browser using ZipCrypto.
- The chain clears Mark of the Web and deletes the original XHTML file.
- Zenox attributes the activity to a Brazilian operational cluster.
Impact: Remote access, surveillance, and data theft if a host is compromised
- 1.Treat Portuguese or Spanish court-themed XHTML or SVG email as malicious.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1027.006 HTML SmugglingT1562.001 Disable or Modify ToolsT1547.001 Registry Run Keys / Startup FolderT1059.001 PowerShell
- Threat actors
- Blind EagleAPT-C-36
- Organizations
- Zenox
From the original article
2 min read at thehackernews.com
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat. "The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.