hacker-news · Crawled Nov 11, 2026
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
1 Actors 2 Malware
Read original article ↗
AI Summary
The threat actor Blind Eagle, also known as APT-C-36, has launched a new campaign targeting organizations in Latin America using phishing emails with judicial and administrative-themed lures in Portuguese and Spanish. These emails deliver a malicious attachment containing a weaponized SVG file that performs HTML smuggling to deploy a JavaScript dropper, which then executes a Visual Basic Script to bypass AMSI and ETW while launching an AsyncRAT-based remote access trojan. The malware establishes persistence via the Windows Startup folder, conducts environment reconnaissance, and targets sensitive data in judicial, fiscal, and educational sectors, with a focus on Colombia.
AI-extracted · verify before operational use
Extracted Entities 3 found
MITRE ATT&CK TTPs 57 techniques
T1021 Remote Services · Lateral Movement T1053.005 Scheduled Task · Execution T1059.001 PowerShell · Execution T1059.005 Visual Basic · Execution T1071.001 Web Protocols · Command And Control T1074 Data Staged · Collection T1082 System Information Discovery · Discovery T1085 T1085 T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1112 Modify Registry · Defense Evasion T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1003 OS Credential Dumping · Credential Access T1006 Direct Volume Access · Defense Evasion T1012 Query Registry · Discovery T1014 Rootkit · Defense Evasion T1027 Obfuscated Files or Information · Defense Evasion T1027.013 Encrypted/Encoded File · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1055 Process Injection · Defense Evasion T1055.012 Process Hollowing · Defense Evasion T1055.015 ListPlanting · Defense Evasion T1057 Process Discovery · Discovery T1068 Exploitation for Privilege Escalation · Privilege Escalation T1069.001 Local Groups · Discovery T1070.004 File Deletion · Defense Evasion T1071.003 Mail Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1102.001 Dead Drop Resolver · Command And Control T1113 Screen Capture · Collection T1133 External Remote Services · Persistence T1134 Access Token Manipulation · Defense Evasion T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1202 Indirect Command Execution · Defense Evasion T1204.002 Malicious File · Execution T1484.001 Group Policy Modification · Defense Evasion T1490 Inhibit System Recovery · Impact T1530 Data from Cloud Storage · Collection T1543.003 Windows Service · Persistence T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1548.002 Bypass User Account Control · Privilege Escalation T1555.003 Credentials from Web Browsers · Credential Access T1558.003 Kerberoasting · Credential Access T1562.001 Disable or Modify Tools · Defense Evasion T1564.003 Hidden Window · Defense Evasion T1570 Lateral Tool Transfer · Lateral Movement T1583 Acquire Infrastructure · Resource Development T1584 Compromise Infrastructure · Resource Development T1586 Compromise Accounts · Resource Development T1608.001 Upload Malware · Resource Development T1685 T1685 T1036 Masquerading · Defense Evasion T1053.003 Cron · Execution T1059 Command and Scripting Interpreter · Execution