Zenox reports Blind Eagle court-notice phishing delivers RAT
Zenox reports Blind Eagle phishing with fake court notices delivers an AsyncRAT-lineage RAT; review mail filtering and attachments.
- Published
- Exploitation
- Not confirmed. Zenox says it could not confirm whether any attacks succeeded, but reports a phishing wave of nearly 3,300 malicious emails.
What happened
According to security firm Zenox, as reported by The Hacker News, the threat actor known as Blind Eagle (also called APT-C-36) has resurfaced with a new campaign against organizations in Latin America. Zenox says the campaign uses judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat The Hacker News. These are Zenox’s findings, and The Hacker News carries them as a single source. No independent confirmation is available in the material we reviewed.
Zenox says the lures are in Portuguese and Spanish and resemble court notifications, fiscalía notices, tutela proceedings and administrative documents. Per The Hacker News, the emails target people who handle cases, contracts, judicial or institutional service requests The Hacker News.
The attack chain as described by The Hacker News:
- One email contained a Colombian judicial-themed XHTML file, identified as a weaponized SVG image. It renders a fake web page impersonating Colombia’s Fiscalía General de la Nación.
- That page uses HTML smuggling to assemble a ZIP archive locally in the browser using ZipCrypto, which the report says circumvents email security controls.
- The ZIP holds a JavaScript dropper disguised as Network Configuration Auditor version 2.7.298. It collects system details such as system version, network profile, memory size and computer name.
- It launches a Visual Basic Script that bypasses AMSI and ETW, and shows a fake criminal-citation page as a distraction.
- The malware deletes the original XHTML file, clears Mark of the Web metadata, and sets up persistence in the Windows Startup folder.
- PowerShell then decodes and launches the final RAT in memory. Zenox describes it as an AsyncRAT fork with DCRat lineage.
Zenox attributes the campaign to APT-C-36 operating through a Brazilian operational cluster, citing the lures, Brazilian infrastructure, operational timezone and regional victimology. That attribution is Zenox’s assessment The Hacker News.
Not confirmed: Zenox told The Hacker News it could not confirm whether any of these attacks succeeded against real-world targets. It reports observing nearly 3,300 malicious emails between late October and early November 2026, and says not all of them targeted Colombia. The source does not name any victim, give a count of compromised systems, or state what data was taken, if any The Hacker News.
Am I affected?
The source does not define an affected product or version, and no CVE is involved. According to Zenox, targets are judicial, fiscal, administrative and educational organizations in Latin America, with Colombia described as a priority target The Hacker News.
You may be exposed if staff in such organizations receive unexpected judicial or administrative notices by email and can open attachments on Windows systems. Whether any given organization was actually compromised is not confirmed. The source does not publish indicators such as file hashes, domains or IP addresses, so those are not confirmed here.
What to do now
The Hacker News article does not include official remediation guidance. The steps below are practical checks derived from the behavior Zenox describes, not recommendations from the source.
- Alert staff who handle court, prosecutor, tutela or contract correspondence to verify unexpected notices through an official channel before opening attachments.
- Review whether your mail filtering handles SVG and XHTML attachments and links that lead to pages delivering ZIP downloads, since Zenox says the chain uses these to evade email controls.
- Search Windows endpoints for a JavaScript file posing as Network Configuration Auditor version 2.7.298, and for unexpected items in the Windows Startup folder.
- If you find a match, isolate the host and investigate it as a possible RAT infection. Zenox says the final payload runs in memory, so file-based checks alone may miss it.
- Watch for updates from Zenox with indicators of compromise, which are not confirmed in the source.