Zenox reported a new Blind Eagle campaign targeting Latin American organizations with Spanish- and Portuguese-language court and administrative lures to deliver an AsyncRAT-related remote access trojan. The emails target people handling cases, contracts, and institutional-service requests.
An attached document opens a page impersonating an official court or agency site. The page builds a password-protected ZIP archive in the browser instead of delivering it as a conventional attachment, which can bypass email controls that inspect attachments. A script inside the archive establishes persistence in Windows’ Startup folder and launches the RAT in memory; it also deletes the original document and clears its download-warning metadata.
For legal, government, education, and other organizations that process official documents by email, this makes a routine workflow the entry point. Zenox reported no evidence of successful attacks, so the campaign’s victim scope remains unconfirmed.