# Blind Eagle APT Targets Latin America With Judicial Phishing Campaign Threat actors use fake court notices to deliver sophisticated remote access trojans. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/b236994a-64f6-44ca-9947-73697206882b ## Resurgence of Blind Eagle The threat actor known as Blind Eagle, or APT-C-36, has launched a new campaign targeting Latin American organizations. Active since 2018, this group utilizes phishing lures themed around judicial and administrative documents. Their primary objective involves delivering remote access trojans to compromise sensitive legal, financial, and institutional information across the region. ## Deceptive Phishing Tactics Attackers send emails containing weaponized XHTML files that mimic official notices from entities like Colombia's Fiscalía General de la Nación. These files function as Scalable Vector Graphics, rendering fake web pages to deceive recipients. By masquerading as legitimate court or fiscal notifications, the group effectively lures individuals into opening malicious attachments. ## HTML Smuggling Mechanism The campaign employs HTML smuggling to bypass standard email security controls. This technique allows the malware to assemble a ZIP archive payload locally within the victim's web browser using ZipCrypto. By constructing the malicious file on the host machine rather than downloading it directly, the attackers successfully evade traditional perimeter security filters. ## Payload and Reconnaissance Inside the ZIP archive, a JavaScript dropper masquerades as Network Configuration Auditor version 2.7.298. Once executed, the script performs environment reconnaissance, gathering system versions, network profiles, and memory details. It specifically targets directories localized in Portuguese and Spanish, ensuring the malware is tailored to the operational environment of its intended regional victims. ## Evasion and Persistence The malware executes a Visual Basic Script to bypass Windows Antimalware Scan Interface and Event Tracing for Windows. To maintain persistence, it sets up execution in the Windows Startup folder while displaying a fake criminal citation page as a distraction. It also clears Mark of the Web metadata to hide its origin. ## Advanced Trojan Architecture The final payload is a remote access trojan that shares structural lineage with AsyncRAT and DCRat. PowerShell is utilized to decode and launch this trojan directly in memory, minimizing the forensic footprint on the infected system. Its configuration and build characteristics confirm its connection to previous operations attributed to the APT-C-36 group. ## Operational Attribution Analysis Researchers link this campaign to a Brazilian operational cluster based on the timezone, regional victimology, and the use of Portuguese and Spanish lures. The targeting of judicial and educational organizations suggests a strategic focus on high-value institutional data. These elements collectively identify the operation as a sophisticated effort by the Blind Eagle group. ## Potential Impact and Risks While no confirmed successful compromises were reported, the potential impact includes full remote access, keystroke logging, and screen capture. Successful exploitation allows attackers to perform extensive surveillance and data exfiltration over encrypted channels. Organizations must improve identity visibility and incident response capabilities to defend against these evolving, region-specific cyber threats. ## Sources covering this story - https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._