Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
Blind Eagle uses fake court notices to deliver RATs across Latin America.
The threat actor Blind Eagle has launched a new campaign targeting Latin American organizations with phishing lures resembling court and administrative documents. These lures deliver a remote access trojan (RAT) that is a fork of AsyncRAT with DCRat lineage. The attack chain involves weaponized SVG images, HTML smuggling, JavaScript droppers, and PowerShell to deploy the final payload.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe Blind Eagle threat actor successfully exploited human trust in official-looking legal documents to deliver a sophisticated RAT payload through a multi-stage attack chain involving SVG files, HTML smuggling, JavaScript, and PowerShell. The root cause is insufficient user awareness of socially engineered phishing lures combined with inadequate endpoint controls that allow scripting languages like PowerShell and JavaScript to execute untrusted payloads. This matters because RATs grant attackers persistent remote access, enabling data theft, lateral movement, and long-term compromise. The use of SVG-based HTML smuggling is specifically designed to bypass traditional email and web gateway filtering, making technical defenses alone insufficient without educated end users who can spot suspicious attachments.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — AsyncRAT
- malware — DCRat
- malware — BitRAT
- malware — Lime RAT
- malware — NjRAT
- malware — Quasar RAT
- malware — Remcos RAT