[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbUYsDlZFPVP-IBx1WBPO8tnLKV7YYkH2bltEjg45-rA":3},{"article":4,"iocs":40,"watch_terms":57,"solutions":58,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"cd148051-e51b-433f-836f-7ea9db37ae20","Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America","blind-eagle-uses-fake-court-notices-to-deliver-remote-access-trojan-across-latin-af8c1d","The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat. \"The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and","The threat actor Blind Eagle has launched a new campaign targeting Latin American organizations with phishing lures resembling court and administrative documents. These lures deliver a remote access trojan (RAT) that is a fork of AsyncRAT with DCRat lineage. The attack chain involves weaponized SVG images, HTML smuggling, JavaScript droppers, and PowerShell to deploy the final payload.","Blind Eagle uses fake court notices to deliver RATs across Latin America.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fblind-eagle-uses-fake-court-notices-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhs4UHnKTj_NJCPa7Jqdntj8tEvZ2PgaY7s9kKK8_X2bxehTUcJeZPFfguJzvW_D0H9XD_q-qLZV2Qq6hqRYDQRYMXpyAzw-6T2yDjFjIY7zhGRLPDPjOalASUgX_Z-M2cEsNqiuys_4QjQ8vY_xl0fnWi2Y_9tT9aAH0WQOAB3D6uDf8yZY8VuphL4TRFG\u002Fs1600\u002Fcourt-phish.jpg","2026-11-10T15:58:44+00:00","2026-11-10T17:00:26.479565+00:00",8,[17,20],{"name":18,"type":19},"Blind Eagle","threat_actor",{"name":21,"type":19},"APT-C-36","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":22,"icon":24,"name":25,"slug":26},null,"Threat Intelligence","threat-intelligence",[28,33,38],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":39},{"id":22,"icon":24,"name":25,"slug":26},[41,44,46,49,51,53,55],{"type":37,"value":42,"context":43},"AsyncRAT","RAT lineage",{"type":37,"value":45,"context":43},"DCRat",{"type":37,"value":47,"context":48},"BitRAT","Previously distributed RAT",{"type":37,"value":50,"context":48},"Lime RAT",{"type":37,"value":52,"context":48},"NjRAT",{"type":37,"value":54,"context":48},"Quasar RAT",{"type":37,"value":56,"context":48},"Remcos RAT",[],{"controls":59,"vendors":143},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":90,"name":91,"problem":92,"products":93},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":119,"name":120,"problem":121,"products":122},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[123,130,137],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":119,"product_name":127,"url":128,"description":129},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":131,"product_name":134,"url":135,"description":136},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":138,"product_name":139,"url":141,"description":142},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":154},"blind-eagle-weaponizes-fake-court-notices-to-deploy-asyncrat-variant-across-latin-america","Blind Eagle Weaponizes Fake Court Notices to Deploy AsyncRAT Variant Across Latin America","The Blind Eagle threat actor successfully exploited human trust in official-looking legal documents to deliver a sophisticated RAT payload through a multi-stage attack chain involving SVG files, HTML smuggling, JavaScript, and PowerShell. The root cause is insufficient user awareness of socially engineered phishing lures combined with inadequate endpoint controls that allow scripting languages like PowerShell and JavaScript to execute untrusted payloads. This matters because RATs grant attackers persistent remote access, enabling data theft, lateral movement, and long-term compromise. The use of SVG-based HTML smuggling is specifically designed to bypass traditional email and web gateway filtering, making technical defenses alone insufficient without educated end users who can spot suspicious attachments.",[149,150,151,152,153],"CIS Control 14: Security Awareness and Skills Training (v8)","CIS Control 9: Email and Web Browser Protections (v8)","MITRE ATT&CK T1566.001: Phishing: Spearphishing Attachment","MITRE ATT&CK T1059.001: Command and Scripting Interpreter: PowerShell","NIS2 Article 21(2)(g)",{"NIS2 Article 21(2)(g)":155,"CIS Control 9: Email and Web Browser Protections (v8)":156,"MITRE ATT&CK T1566.001: Phishing: Spearphishing Attachment":157,"CIS Control 14: Security Awareness and Skills Training (v8)":158,"MITRE ATT&CK T1059.001: Command and Scripting Interpreter: PowerShell":159},"This point mandates basic cyber hygiene and training for staff, which would directly address the human susceptibility to official-looking phishing lures that enabled this campaign to succeed.","This control calls for filtering and blocking dangerous email attachment types and web content, which would have intercepted the weaponized SVG and HTML smuggling payloads before reaching end users.","Blind Eagle delivered the RAT through phishing emails with malicious SVG attachments disguised as court documents, directly matching this technique.","This control requires organizations to establish training programs that help users recognize phishing and social engineering lures, which is the primary attack vector Blind Eagle exploited with fake court notices.","The attack chain used PowerShell as a final-stage dropper mechanism, which this technique covers and which endpoint controls like Constrained Language Mode are designed to restrict."]