The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.
"The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and administrative documents," Zenox said in a report shared with The Hacker News. Assessed to be a Spanish-speaking group and active since 2018, Blind Eagle (aka APT-C-36) has a track record of using spear-phishing lures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.
Attack chains begin with phishing emails targeting individuals who handle cases, contracts, judicial, or institutional service requests to trick them into opening a malware-laced attachment. One email containing a Colombian judicial-themed XHTML file has been identified as a weaponized Scalable Vector Graphics (SVG) image that renders a bogus web page impersonating Colombia's Fiscalía General de la Nación, also referred to as the Office of the Attorney General.
The web page, for its part, employs a technique known as HTML smuggling to assemble the next-stage ZIP archive payload locally in the web browser using ZipCrypto, thereby circumventing email security controls. Present within the ZIP archive is a JavaScript dropper that masquerades as Network Configuration Auditor version 2.7.298.
The JavaScript code conducts environment reconnaissance, and collects details such as system version, network profile, installation date, memory size, computer name, environment variables, and directories localized in Portuguese and Spanish. Upon execution, it launches a Visual Basic Script that performs Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypass, while displaying a fake criminal-citation page as a distraction mechanism.
In parallel, the malware also takes steps to delete the original XHTML artifact, clears Mark of the Web (MotW) metadata, and sets up persistence on the host under the Windows Startup folder so that it's automatically executed on system startup. The attack culminates with the use of PowerShell to decode and launch the final RAT payload in memory.
The trojan is an AsyncRAT fork with DCRat lineage based on code structure, configuration, build characteristics, and observed behavior. Although there is no evidence that these attacks have been successful against real-world targets, a successful compromise could result in environment reconnaissance, document collection, remote access, keystroke and screen capture, surveillance, and data exfiltration over an encrypted channel.
"The targeting of judicial, fiscal, administrative and educational organizations gives the operation access to highly sensitive legal, financial and institutional information," Zenox said. "Combined with the Portuguese and Spanish lures, Brazilian infrastructure, operational timezone and regional victimology, these elements establish the campaign as an APT-C-36 operation conducted through a Brazilian operational cluster."
