Blind Eagle returns with fake court notices to deploy RAT across Latin America

The threat actor known as Blind Eagle (APT-C-36) has launched a new phishing campaign targeting organizations across Latin America. The group sends emails with Portuguese and Spanish lures that impersonate court notifications, fiscal documents, and administrative proceedings from Colombian judicial institutions. The emails contain a weaponized SVG image that renders a fake web page impersonating Colombia's Office of the Attorney General, using HTML smuggling to bypass email security controls and deliver malicious payloads.

Once opened, the malware conducts extensive reconnaissance to collect system information, bypasses Windows security mechanisms, and sets up persistence through the Windows Startup folder. The final payload is a remote access trojan that combines features from both AsyncRAT and DCRat, giving attackers full control over compromised systems. This campaign highlights how threat actors are increasingly using localized, convincing lures that exploit regional legal systems to target specific victims.