The Court Notice Was Fake. The Backdoor Was Real.

A court notice lands in your inbox. It looks official — the seal, the case language, the urgency of a legal deadline. You open the attachment to see what it is about. That is the whole attack. A threat group known as Blind Eagle has sent nearly 3,300 emails like that across Latin America in the past few weeks, each one carrying a remote access trojan dressed up as a judicial document.

Blind Eagle, also tracked as APT-C-36, is a Spanish-speaking group that has run spear-phishing campaigns since 2018. Its specialty is not exotic zero-days. It is social engineering done well: emails that look like they come from courts, prosecutors, and government offices, aimed at the people who handle cases, contracts, and institutional requests. Security firm Zenox, which shared its research with The Hacker News, says the latest campaign ran from late October into early November 2026, with Portuguese and Spanish lures impersonating court notifications, fiscalía notices, tutela proceedings, and administrative documents.

The attachment is a fake courtroom

One email carried a Colombian judicial-themed XHTML file. Inside it sat a weaponized SVG image that renders a bogus web page impersonating Colombia’s Fiscalía General de la Nación — the Office of the Attorney General. The page looks like a real government portal. It is not. It is the delivery mechanism.

Inside the ZIP is a JavaScript dropper posing as “Network Configuration Auditor version 2.7.298” — a name chosen to sound like routine IT software. Before anything loud happens, it quietly studies the machine: system version, network profile, installation date, memory size, computer name, environment variables, and directories localized in Portuguese and Spanish.

The distraction is the point

Once the dropper runs, it launches a Visual Basic Script that bypasses two of Windows’ main defenses: the Antimalware Scan Interface (AMSI), which lets security software inspect scripts before they run, and Event Tracing for Windows (ETW), which logs what is happening on the system. While those defenses are being switched off, the victim sees a fake criminal-citation page — a distraction that keeps them looking at the “court document” while the real work happens underneath.

The malware also cleans up after itself. It deletes the original XHTML file, clears the Mark of the Web metadata that tells Windows a file came from the internet, and sets itself to run automatically from the Windows Startup folder every time the machine boots. The final step is PowerShell decoding and launching the remote access trojan directly in memory, where it never has to touch the disk as a file.

The trojan itself is an AsyncRAT fork with DCRat lineage, identified by its code structure, configuration, build characteristics, and observed behavior. That fits Blind Eagle’s history: the group has spent years distributing commodity remote access tools — AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT — through the same kind of carefully written lures.

Why courts, and why Colombia

The targeting is deliberate. Judicial, fiscal, administrative, and educational organizations hold exactly the kind of information that is hardest to replace: legal files, financial records, institutional data. Zenox notes that the Portuguese and Spanish lures, the Brazilian infrastructure, the operational timezone, and the regional victimology all point to an APT-C-36 operation run through a Brazilian operational cluster.

One caveat: Zenox could not confirm that any of these attacks succeeded against a real-world target. The 3,300 emails are confirmed; the infections are not. The campaign’s scale still shows a group that expects some of those emails to work.

What to do about it

Start with the inbox. Any email claiming to be a court notice, a prosecutor’s office, or a government agency should be verified through an official channel — a known phone number or the agency’s real website — before any attachment is opened. Real courts do not send case documents as XHTML files, and they do not rush you into opening them.

On the technical side, treat XHTML and SVG attachments as high-risk: block them at the email gateway where possible, or flag them for inspection. Monitor the Windows Startup folder for new entries, watch for PowerShell launching payloads in memory, and make sure AMSI and ETW are enabled and reporting — a machine where both go quiet at once is worth investigating.

Finally, train the people who handle legal and administrative mail. They are the target precisely because their job requires opening documents from strangers. A five-minute verification habit — call the court, check the portal, confirm the sender — is the cheapest defense against an attack that is designed to look like their daily work.

The court notice was fake. The backdoor was real. Blind Eagle is counting on the fact that, in a busy office, the two look exactly the same — until someone checks.

Source: The Hacker News, based on research by Zenox. For a related look at how fake software downloads become backdoors, see our earlier story on fake security tools on GitHub, and for another case of a convincing impersonation, the deepfake CEO scam that stole $129 million.