Blind Eagle Uses Fake Court Notices to Deliver AsyncRAT Malware to Latin American Targets
A threat group known as Blind Eagle is sending Latin American organizations bogus court notices that hide an AsyncRAT‑based trojan, using weaponized SVG files, HTML smuggling, and in‑memory execution to evade detection. The campaign exploits trust in official‑looking legal messages to gain remote access to victims’ systems.
A new phishing campaign in Latin America is turning trust in legal notices into a security weakness. Blind Eagle, a known threat group, is targeting organizations in the region with fake court communications that deliver an AsyncRAT‑based remote‑access trojan.
According to technical reporting, the attackers send messages that look like summonses or other court documents. These emails carry weaponized SVG files, a format usually associated with images, which kick off the infection sequence.
Behind the scenes, Blind Eagle is using HTML smuggling to assemble and launch the malware on the victim’s machine. In this technique, malicious code is hidden inside what appears to be harmless web content and reconstructed inside the browser, helping it slip past some perimeter defenses. The payload then runs in memory, which reduces the traces left on disk and can make detection harder.
The final tool in the chain is AsyncRAT. Once installed, this remote‑access trojan can give attackers broad control over an infected system, including the ability to log keystrokes, capture screenshots, and exfiltrate files.
The campaign targets organizations in Latin America that routinely receive legal correspondence, making staff more likely to open and act on such messages quickly. That includes courts themselves, but also government offices and private entities that handle official documents.
The combination of realistic legal lures and technically advanced delivery methods shows how groups like Blind Eagle adapt both to local context and to modern security controls. It also underlines the need for organizations in the region to harden processes around electronic legal notices.
Warning signs to watch for include unexpected court messages that ask recipients to open attached SVG files, as well as unusual outbound traffic that may indicate HTML smuggling and AsyncRAT activity. How quickly regional authorities and computer emergency response teams share these indicators will shape the overall impact of this campaign.
Sources
- OSINT