AsyncRAT

Blind Eagle APT-C-36 Resurfaces with Judicial-Themed Phishing Delivering AsyncRAT-DCRat Hybrid RAT Across Latin America

The threat actor known as Blind Eagle has launched a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan that shares its lineage with AsyncRAT and DCRat. The campaign uses Portuguese and Spanish lures resembling court notifications, fiscalía notices, tutela proceedings, and administrative documents. Attack chains begin with phishing emails containing weaponized XHTML files that render as SVG images impersonating Colombia's Fiscalía General de la Nación. The page employs HTML smuggling with ZipCrypto to assemble a ZIP archive payload locally in the browser. Inside the archive is a JavaScript dropper that performs environment reconnaissance before launching a VBScript to bypass AMSI and ETW, display a fake criminal-citation page, and establish persistence. The final payload is an AsyncRAT fork with DCRat lineage decoded and executed in memory via PowerShell, enabling reconnaissance, document collection, keystroke logging, screen capture, and encrypted data exfiltration.