The cyber threat group known as Blind Eagle has launched a fresh wave of attacks aimed at Latin American entities, utilizing phishing tactics with legal-themed baits to deploy a remote access trojan (RAT) related to AsyncRAT and DCRat. This campaign, identified by the security firm Zenox, employs official-looking notifications in Portuguese and Spanish to deceive recipients.
Targeted Phishing Tactics
Blind Eagle, also referred to as APT-C-36, has been active since 2018 and is known for distributing various RATs through spear-phishing. Their latest operation involves emails designed to trick individuals handling legal and institutional tasks into downloading malware-infected attachments.
A notable instance involves a phishing email featuring a Colombian legal-themed XHTML file, which acts as a weaponized SVG image. This image impersonates Colombia’s Fiscalía General de la Nación, using a technique called HTML smuggling to locally compile a malicious ZIP archive, bypassing email security measures.
Technical Execution of the Attack
The ZIP archive contains a JavaScript dropper disguised as a legitimate tool, which gathers system information and executes a Visual Basic Script. This script bypasses security mechanisms and displays a fake legal page to distract users.
Subsequently, the malware deletes traces of its initial entry point and establishes persistence within the system’s startup processes. The attack concludes with PowerShell execution to load the RAT directly into memory.
Implications and Future Outlook
While Blind Eagle’s impact on real-world targets remains unconfirmed, a breach could allow for extensive surveillance and data theft. The campaign’s focus on judicial and administrative sectors poses a significant threat to sensitive information.
Zenox highlights the combination of regional tactics, such as Portuguese and Spanish language lures, with Brazilian infrastructure, indicating a strategic operation by APT-C-36. As cyber threats evolve, organizations must enhance their defenses to mitigate such sophisticated attacks.
