Blind Eagle Uses Fake Court Notices to Deliver RAT in Latin America
Summary
Researchers report that Blind Eagle used judicial-themed phishing in Latin America to deliver an AsyncRAT fork with DCRat lineage, using HTML smuggling, script-based reconnaissance, AMSI/ETW bypass, persistence and in-memory execution. No successful attacks were
Key points
- Zenox reported Portuguese- and Spanish-language phishing lures impersonating court, fiscalía and administrative notices.
- A weaponized XHTML file used an SVG image to imitate Colombia’s Fiscalía General de la Nación.
- HTML smuggling assembled a ZIP archive in the browser, containing a JavaScript dropper disguised as Network Configuration Auditor version 2.7.298.
- The dropper gathered system and environment details, then launched a Visual Basic Script that bypassed AMSI and ETW while displaying a fake criminal-citation page.
- The malware deleted the original XHTML file, cleared Mark of the Web metadata and established persistence in the Windows Startup folder.
- PowerShell decoded and launched the final RAT in memory; Zenox described it as an AsyncRAT fork with DCRat lineage based on code and behavior.
- The article says there is no evidence the attacks succeeded against real-world targets; potential impacts are described as possible outcomes of a successful compromise.
Article Details
- Attack Vectors
- Phishing emails with judicial- and administrative-themed attachments target people handling cases, contracts, judicial matters, or institutional service requests.
- A weaponized XHTML file contains an SVG image that renders a fake page impersonating Colombia's Fiscalía General de la Nación.
- HTML smuggling assembles a ZIP archive locally in the browser to bypass email security controls.
- A JavaScript dropper launches a Visual Basic Script, which uses a fake criminal-citation page as a distraction.
- PowerShell decodes and launches the final RAT payload in memory.
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe dropper collects details about the system's network profile.T1027.006 · HTML SmugglingHTML smuggling assembles the next-stage ZIP archive locally in the browser.T1059.001 · PowerShellPowerShell decodes and launches the final RAT payload in memory.T1059.005 · Visual BasicThe JavaScript dropper launches a Visual Basic Script that performs bypasses and displays a fake citation page.T1059.007 · JavaScriptA JavaScript dropper conducts reconnaissance and launches a Visual Basic Script.T1070.004 · File DeletionThe malware deletes the original XHTML artifact.T1082 · System Information DiscoveryThe JavaScript dropper collects system details including system version, installation date, memory size, computer name, and environment variables.T1140 · Deobfuscate/Decode Files or InformationPowerShell decodes the final RAT payload before launching it in memory.T1547.001 · Registry Run Keys / Startup FolderThe malware establishes persistence under the Windows Startup folder for execution at system startup.T1553.005 · Mark-of-the-Web BypassThe malware clears Mark of the Web metadata from the original XHTML artifact.T1562.001 · Disable or Modify ToolsThe Visual Basic Script performs AMSI and ETW bypasses.T1566.001 · Spearphishing AttachmentPhishing emails deliver malware-laced attachments to targeted individuals.
Threat Actors
Malware
AsyncRATphishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.BitRATAPT-C-36) has a track record of using spear-phishing lures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.DCRatphishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.Lime RAThas a track record of using spear-phishing lures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.njRATtrack record of using spear-phishing lures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.Quasar RATof using spear-phishing lures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.Remcos RATlures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.