Severity: High | Priority: 2
Blind Eagle, also known as APT-C-36, is a Spanish-speaking threat group active since at least 2018 and best known for attacks on organisations in Colombia and elsewhere in Latin America. It is running a new phishing campaign that uses judicial and administrative lures. The emails, written in Spanish and Portuguese, pose as court notifications, notices from Colombia’s Office of the Attorney General (Fiscalía General de la Nación), constitutional protection proceedings and official administrative documents. They target people who handle cases, contracts, judicial matters or service requests in judicial, fiscal, administrative and educational organisations. Researchers believe this wave is run by a Brazil-based operational cluster.
The attachment is an SVG image file that opens a convincing fake Attorney General web page. Hidden code in the image builds a password-protected ZIP file inside the browser, a technique called HTML smuggling, so the malicious file never passes through email filters in a form they can inspect. The ZIP contains a JavaScript file disguised as a network auditing tool. It profiles the computer, then launches a script that disables Windows’ built-in script scanning and event tracing and shows a fake criminal citation page to keep the victim distracted. It then deletes the original attachment, removes the “downloaded from the internet” marking from its files, and sets itself to start with Windows. Finally, PowerShell runs the main payload directly in memory: a variant of the AsyncRAT remote-access trojan derived from DCRat. It gives the attackers remote control of the computer, keystroke and screen capture, document theft and encrypted data exfiltration.
On any affected computer, isolate it from your network and check for:
Rebuild the computer from a clean image and reset the user’s passwords. To reduce exposure, block or quarantine SVG, XHTML and HTML attachments at the email gateway unless there is a business need for them. Alert on scripts that disable AMSI or event tracing. Remind staff who handle legal, judicial or administrative correspondence to verify any unexpected court or prosecutor notice through official channels before opening attachments.