Threats · 2 days ago
Zenox reported a new Blind Eagle campaign targeting Latin American organizations with Spanish- and Portuguese-language court and administrative lures to deliver an AsyncRAT-related remote access trojan. The emails target people handling cases, contracts, and institutional-service requests.
An attached document opens a page impersonating an official court or agency site. The page builds a password-protected ZIP archive in the browser instead of delivering it as a conventional attachment, which can bypass email controls that inspect attachments. A script inside the archive establishes persistence in Windows’ Startup folder and launches the RAT in memory; it also deletes the original document and clears its download-warning metadata.
For legal, government, education, and other organizations that process official documents by email, this makes a routine workflow the entry point. Zenox reported no evidence of successful attacks, so the campaign’s victim scope remains unconfirmed.
1 source covering this story
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
Blind Eagle targets Latin American organizations with judicial phishing lures and HTML smuggling to deliver an AsyncRAT-based trojan.
Part of the PlainSec briefing for 2026-11-11