"The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and administrative documents," Zenox said in a report shared with The Hacker News.
Blind Eagle (APT-C-36) and the Brazilian operational cluster
Security researchers at Zenox attribute the campaign to the threat actor known as Blind Eagle, also tracked as APT-C-36. Zenox assesses the group to be Spanish-speaking and active since 2018, with a documented history of distributing commodity remote access trojans such as AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT. Zenox further links the present operation to a Brazilian operational cluster, citing Portuguese- and Spanish-language lures, Brazilian infrastructure, operational timezone, and regional victimology as shaping that determination.
Judicial and administrative-themed lures aimed at Latin America
The campaign uses spear-phishing messages crafted for recipients who handle cases, contracts, judicial or institutional service requests. Emails impersonate court notifications, fiscalía notices, tutela proceedings and other administrative documents in Portuguese and Spanish. One observed sample carried a Colombian judicial-themed XHTML file that weaponized a Scalable Vector Graphics (SVG) image to render a bogus web page impersonating Colombia's Fiscalía General de la Nación (the Office of the Attorney General).
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHTML smuggling, ZipCrypto and a JavaScript dropper masquerading as a utility
That faux web page uses HTML smuggling to assemble a ZIP archive locally in the victim's browser. The archive is constructed with ZipCrypto — a choice that, Zenox says, enables the payload to move past email security controls. The ZIP contains a JavaScript dropper that pretends to be "Network Configuration Auditor version 2.7.298." On execution, the JavaScript conducts environment reconnaissance, collecting system version, network profile, installation date, memory size, computer name, environment variables and directories localized in Portuguese and Spanish.
VBS AMSI/ETW bypass, deception and PowerShell-loaded AsyncRAT fork
After the JavaScript stage, the chain launches a Visual Basic Script that performs Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypasses while displaying a fake criminal-citation page to distract the user. The malware also deletes the original XHTML artifact, clears Mark of the Web (MotW) metadata, and establishes persistence by placing itself in the Windows Startup folder for automatic execution at system start. The final step uses PowerShell to decode and run the remote access trojan in memory. Zenox identifies the trojan as an AsyncRAT fork with DCRat lineage based on code structure, configuration, build characteristics and observed behavior.
Targets, potential impacts, and the sensitivity of judicial data
Zenox highlights the campaign's focus on judicial, fiscal, administrative and educational organizations. Although the researchers note there is no evidence these attacks have successfully compromised real-world targets, they outline likely impacts of a successful breach: environment reconnaissance, document collection, remote access, keystroke and screen capture, surveillance and data exfiltration over an encrypted channel. Zenox warns that targeting institutions that hold legal, financial and institutional records "gives the operation access to highly sensitive legal, financial and institutional information."
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Watch for HTML smuggling and browser-assembled ZIP archives (ZipCrypto usage) as a delivery technique; treat weaponized SVG/XHTML artifacts and JavaScript droppers masquerading as legitimate utilities as high-risk indicators.
- Policymakers and regulators: The campaign’s use of judicial and fiscal lures that impersonate national institutions, including a page mimicking Colombia's Fiscalía General de la Nación, underscores the cross-border sensitivity of attacks that target legal and administrative processes.
- Affected enterprises and procurement leaders: Organizations that process judicial notices, contracts or institutional service requests should consider the risk that trusted-format documents and localized language lures may be weaponized to deliver memory-resident RATs with AMSI/ETW bypass capabilities.
The Blind Eagle campaign described by Zenox demonstrates a layered, regionally tailored approach: social-engineered lures in Portuguese and Spanish, browser-based HTML smuggling to evade email defenses, a multi-stage dropper that erases traces and disables protections, and an AsyncRAT-derived payload launched in memory. Even without confirmed intrusions, the combination of techniques and the focus on legally sensitive victims creates a potent risk profile that defenders in Latin America and those handling cross-border judicial workflows will need to prioritize.
