Newshot Blind Eagle Uses Fake Court Notices to Deliver RAT, Attacks Hit Latin America
The threat group known as Blind Eagle has recently resurfaced, launching a new wave of attacks against organizations in Latin America. The gang uses judicial and administrative themed phishing lures to deliver a RAT related to AsyncRAT and DCRat.
"The campaign uses Portuguese and Spanish lures disguised as court notices, prosecutor's office announcements, protection order documents, and administrative files," Zenox said in a report provided to The Hacker News.
Blind Eagle, also known as APT-C-36, is assessed to be a Spanish-speaking hacking group that has been active since 2018. The group has long used spear-phishing lures to drop various commodity RATs such as AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.
The initial entry point for this attack is phishing emails targeting staff within organizations who handle cases, contracts, judicial or institutional service requests, tricking them into opening attachments carrying malicious programs.
Phishing Attachments Disguised as Judicial Documents, HTML Smuggling Bypasses Email Protections
Researchers found that one type of XHTML attachment disguised as Colombian judicial documents is actually a weaponized Scalable Vector Graphics (SVG) file. When a user opens the file, they see a fake webpage impersonating the official site of Colombia's Office of the Attorney General.
The fake webpage uses HTML smuggling techniques to assemble the next-stage ZIP payload within the user's local browser via the ZipCrypto algorithm, directly bypassing detection by email security protections.
The archive contains a JavaScript dropper disguised as a network configuration auditing tool with version number 2.7.298. This malicious code performs environmental reconnaissance, collecting information such as the system version, network configuration, system installation date, memory size, computer name, environment variables, and the paths of Portuguese and Spanish localized directories on the system.
Multi-Stage Payload Delivered in Stages, RAT Loaded into Memory After Host Persistence
After the JavaScript file runs, it launches a VBS script. This script can bypass Windows Antimalware Scan Interface (AMSI) and Windows Event Tracing (ETW) protections while popping up a fake criminal summons page to distract the user.
At the same time, the malware deletes the original XHTML file, clears the file's Mark of the Web (MotW) metadata, and erases traces of intrusion. It also configures a persistence mechanism in the Windows Startup folder to ensure the malicious code executes automatically after a system reboot.
In the final stage of the attack chain, the malware decodes and loads the final RAT payload in memory via PowerShell. Based on analysis of code structure, configuration parameters, compilation characteristics, and actual behavior, researchers determined that the trojan is a derivative of AsyncRAT with code lineage characteristics of DCRat.
Successful Intrusions Can Steal Sensitive Information, Attribution Confirms APT-C-36 Activity
There is currently no evidence that these attacks have succeeded in real-world environments. If attackers successfully compromise a target system, they can conduct environmental reconnaissance, steal documents, establish remote control channels, log keystrokes, capture screenshots, conduct persistent surveillance, and exfiltrate stolen data through encrypted channels.
"Targeted attacks against judicial, prosecutorial, administrative, and educational institutions can give attackers access to highly sensitive legal, financial, and internal institutional information. Combined with the Portuguese and Spanish lures used in this campaign, the attack infrastructure deployed in Brazil, the time zones corresponding to the attack activity, and the regional victim characteristics, it can be determined that this is an attack campaign launched by APT-C-36 through its Brazilian operational cluster," Zenox said.
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America