Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America Ravie LakshmananNov 10, 2026Threat Intelligence / Malware The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat. "The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and administrative documents," Zenox said in a report shared with The Hacker News. Assessed to be a Spanish-speaking group and active since 2018, Blind Eagle (aka APT-C-36) has a track record of using spear-phishing lures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT. Attack chains begin with phishing emails targeting individuals who handle cases, contracts, judicial, or institutional service requests to trick them into opening a malware-laced attachment. One email containing a Colombian judicial-themed XHTML file has been identified as a weaponized Scalable Vector Graphics (SVG) image that renders a bogus web page impersonating Colombia's Fiscalía General de la Nación, also referred to as the Office of the Attorney General. The web page, for its part, employs a technique known as HTML smuggling to assemble the next-stage ZIP archive payload locally in the web browser using ZipCrypto, thereby circumventing email security controls. Present within the ZIP archive is a JavaScript dropper that masquerades as Network Configuration Auditor version 2.7.298. The JavaScript code conducts environment reconnaissance, and collects details such as system version, network profile, installation date, memory size, computer name, environment variables, and directories localized in Portuguese and Spanish. Upon execution, it launches a Visual Basic Script that performs Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypass, while displaying a fake criminal-citation page as a distraction mechanism. In parallel, the malware also takes steps to delete the original XHTML artifact, clears Mark of the Web (MotW) metadata, and sets up persistence on the host under the Windows Startup folder so that it's automatically executed on system startup. The attack culminates with the use of PowerShell to decode and launch the final RAT payload in memory. The trojan is an AsyncRAT fork with DCRat lineage based on code structure, configuration, build characteristics, and observed behavior. "The targeting of judicial, fiscal, administrative and educational organizations gives the operation access to highly sensitive legal, financial and institutional information," Zenox said. "Combined with the Portuguese and Spanish lures, Brazilian infrastructure, operational timezone and regional victimology, these elements establish the campaign as an APT-C-36 operation conducted through a Brazilian operational cluster." Zenox told The Hacker News that it could not confirm whether any of these attacks had succeeded against real-world targets. However, during the campaign period between late October and early November 2026, it observed a large-scale wave of targeted phishing involving nearly 3,300 malicious emails. While not all of these messages targeted organizations in Colombia, the country continues to remain a priority target for Blind Eagle for a combination of reasons. "The repeated targeting of Colombia likely reflects multiple factors, with one of the main enabling factors being the structural vulnerabilities and uneven security maturity across parts of the country's critical, public, financial, and private-sector infrastructure," Zenox security researcher Gabriel Alves said. "These conditions may increase the likelihood of successful compromises and offer greater opportunities to monetize access, steal sensitive data or funds, or reuse compromised credentials against critical systems. This is further supported by regional actors' familiarity with the Colombian context and is consistent with patterns observed among Latin American threat actors." (The story was updated after publication to include additional insights from Zenox.) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cyber espionage, email security, Malware, Phishing, Threat Intelligence, Windows Security Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads The Flood is Coming And The Pipes Were Already Full Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Attend Live Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk