Threat reportMalwareTL-2026-5664

Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America

highACTIVE

Blind Eagle (APT-C-36) is running a phishing campaign with Spanish and Portuguese court and fiscalía-themed lures. It uses SVG/XHTML HTML smuggling, a JavaScript dropper, an AMSI/ETW-bypassing VBScript and in-memory PowerShell to deploy a RAT forked from AsyncRAT with DCRat lineage.

Key facts

Identifiers	TL-2026-5664
Also known as	Last Heist
Severity	HIGH
First disclosed	2026-11-04
Affected products	Microsoft Windows (user endpoints; JScript/VBScript via Windows Script Host, PowerShell, .NET Framework 4.8)
Attribution	APT-C-36 (high confidence)
Malware	AsyncRAT
Tools	DCRAT - S9017
MITRE ATT&CK techniques	T1005 Data from Local System, T1012 Query Registry, T1027.006 HTML Smuggling, T1027.017 SVG Smuggling, T1036 Masquerading, T1056.001 Keylogging, T1059.001 PowerShell, T1059.005 Visual Basic, T1059.007 JavaScript, T1070.004 File Deletion, T1082 System Information Discovery, T1113 Screen Capture and 10 more in the attack flow
Motivation	ESPIONAGE
Target sectors	government administration, judicial, legal, education, administrative
Target regions	Latin America, colombia, brazil
Detection rules	9 (1 shown free)
Sources	6 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5664 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Blind Eagle APT-C-36 JavaScript Dropper Run by Windows Script Host from Archive/Download Path

TL-2026-5664: detects wscript.exe/cscript.exe executing a .js file from a ZIP extraction folder (Temp1_*), the user Downloads folder or Temp, or referencing the campaign's Demanda_Ejecutiva_* ZIP / 'Network Configuration Auditor v2.7.298' masquerade. This is the stage-2 JavaScript dropper (T1059.007, T1204.002) opened after the HTML/SVG-smuggled ZIP from a Fiscalia-themed phishing lure (T1566.001) is extracted. Script hosts running .js directly from user-writable archive paths are rare in managed estates and are a strong behaviour-first signal independent of changing filenames or hashes.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1204.002, T1059.007, T1566.001
Data sources: sysmon, microsoft_defender_for_endpoint_DeviceProcessEvents, windows_process_creation
Severity: high
Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\wscript.exe" OR Image="*\\cscript.exe") (CommandLine="*Temp1_*" OR CommandLine="*Demanda_Ejecutiva*" OR CommandLine="*Network Configuration Auditor*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\AppData\\Local\\Temp\\*") | where match(CommandLine, "(?i)[.]jse?([^a-z0-9]|$)") | eval parent_class=if(match(ParentImage, "(?i)(explorer|7zfm|7zg|winrar|winzip)[.]exe$"), "archive_or_shell", "other") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(parent_class) as parent_class by host, User, ParentImage, Image | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine matches regex @"(?i)[.]jse?([^a-z0-9]|$)"
| where ProcessCommandLine has_any ("Temp1_", "Demanda_Ejecutiva", "Network Configuration Auditor", "Downloads")
| extend ParentClass = iff(InitiatingProcessFileName in~ ("explorer.exe", "7zFM.exe", "7zG.exe", "WinRAR.exe"), "archive_or_shell", "other")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ParentClass
| order by Timestamp desc

Sigma

title: Script Host Executing JavaScript From Archive or Download Path - Blind Eagle TL-2026-5664
id: 8d3e1c52-6a47-4b19-a0f3-5e2b7c9d4a11
status: experimental
description: Detects wscript.exe or cscript.exe running a .js file from a ZIP extraction folder (Temp1_), the Downloads folder, or referencing the Blind Eagle Demanda_Ejecutiva ZIP / Network Configuration Auditor masquerade (stage-2 JavaScript dropper).
references:
  - https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/
  - https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html
author: Threadlinqs Team
date: 2026/11/10
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_path:
    CommandLine|contains:
      - 'Temp1_'
      - 'Demanda_Ejecutiva'
      - 'Network Configuration Auditor'
      - '\Downloads\'
  selection_js:
    CommandLine|contains: '.js'
  condition: selection_img and selection_path and selection_js
falsepositives:
  - Administrators or developers running legitimate .js maintenance scripts from Downloads
  - Software installers that unpack JScript helpers into Temp
level: high

Known false positives:

Administrators or developers running legitimate .js maintenance scripts from the Downloads folder
Software installers that unpack JScript helper scripts into Temp during installation

Tuning notes: Replace index=sysmon with the index that holds Sysmon EventCode 1 in your environment. Allow-list signed internal admin scripts by hash or path. If Windows Script Host is blocked by policy for .js, raise to critical and drop the Downloads/Temp path filter to alert on every script-host .js execution.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

Blind Eagle HTML/SVG-Smuggled ZIP and Fiscalia-Themed XHTML Lure Written to Disk · unlock with TL Creds
Blind Eagle Script Host Spawning PowerShell for In-Memory RAT Staging · unlock with TL Creds
Blind Eagle Dynamic-DNS Egress from Script Hosts and PowerShell · unlock with TL Creds
Blind Eagle Nested Script-Host Chain (JavaScript Dropper to VBScript Stage) · unlock with TL Creds
Blind Eagle PowerShell AMSI/ETW Tampering and In-Memory .NET Assembly Load · unlock with TL Creds
Blind Eagle Lure Distribution Domain [indicator] Access · unlock with TL Creds
Blind Eagle Startup-Folder VBScript Shortcut Persistence (SvcConfigZNn4r6 / index_ZNn4r6) · unlock with TL Creds
Blind Eagle RAT C2 Connection or DNS Lookup ([indicator] / [indicator]:4782) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5664.

Sample indicators (3 of 16)

IP address: 45.146.81[.]142
Domain: crp2026[.]online
File hash: e7666af17732e9a3954f6308bc52866b937ac67099faa212518d5592baca5d44

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

16 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Targets are judicial, fiscal, administrative and educational organizations in Latin America.

Zenox (report 'Last Heist: New APT-C-36 Infection Wave in LatAm', 4 November 2026, covered by The Hacker News on 10 November 2026) documents a new Blind Eagle (APT-C-36) infection wave. The initial lure is an email attachment, for example '43262 CONSTANCIA-Despacho.COL.97-126.xhtml' (about 4.2 MB), which is an SVG disguised as XHTML. It renders a fake Fiscalía General de la Nación page (display title 'CITACION PENAL, FISCALIA'; lure themes include tutela proceedings and administrative circulars). The page assembles a ZipCrypto-encrypted ZIP locally in the browser (HTML smuggling), with the password shown on the page. The ZIP (Demanda_Ejecutiva_*__EXP2026-XXXX.zip) holds a JavaScript dropper that displays itself as 'Network Configuration Auditor v2.7.298'.

The JavaScript dropper creates Scripting.FileSystemObject and WScript.Shell objects, performs environment reconnaissance (environment variables, registry values such as install date, network profile, product name and physical memory, and multilingual English/Portuguese/Spanish directory enumeration of Downloads, Desktop and Documents), then decodes and chains stages 3, 4 and 5. It deletes the original XHTML and removes the Mark-of-the-Web (Zone.Identifier). Stage 5 is a VBScript that bypasses AMSI and ETW, stores the encrypted payload in environment variables, creates a reversed fake XHTML copy (index_ZNn4r6.xhtml under %APPDATA%\Microsoft\), an auxiliary copy under C:\Users\Public\, and a Startup-folder shortcut targeting SvcConfigZNn4r6.vbs for persistence. Stage 6 is PowerShell that decodes the payload (AES-256-ECB, custom Base85, GZIP) and loads an x64 RAT in memory through Reflection and delegates; no final payload is written to disk.

The RAT is a PE64 DLL written in VB.NET (.NET Framework 4.8) with obfuscation, virtualization and modified build information. Zenox classifies it, with high confidence, as an AsyncRAT fork derived from DCRat (classes Client.Settings, CryptoCore, Aes256, MutexControl, Packet, MsgPack, ProcessCritical, IdSender; development markers Boss/Client77). Named capabilities are a hidden desktop (CreateDesktopW), keylogging (GetKeyboardLayout/ToUnicodeEx), screen capture (d3d11), video streaming (MFPlat), token impersonation and input blocking (BlockInput). Configuration fields (Hosts, Ports, Version, Key, MTX, Certificate) are redacted in the report. C2 is the dynamic-DNS host vpfinal142.myvnc.com (45.146.81.142, port 4782); lure distribution is via crp2026.online behind Cloudflare.

Attribution: Zenox attributes the activity to APT-C-36 with high confidence and to a Brazilian operational cluster (Portuguese lures and code references, hosting in Cotia, Brazil on ASN 265919, America/Sao_Paulo timezone). Blind Eagle is a Spanish-speaking group active since 2018 that has historically used commodity RATs (AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, Remcos). Caveats from the sources: Zenox executed the chain only in controlled lab VMs and observed no privilege escalation or lateral movement; The Hacker News states there is no evidence the attacks have succeeded against real-world targets; and the published report withholds full hashes, mutex, ZIP password and keys. The related Zscaler ThreatLabz report (16 December 2025) on an earlier Blind Eagle campaign (SVG judicial portal, Caminho downloader, DCRat) provides corroborating context for the actor's SVG/DCRat tradecraft.

MITRE ATT&CK techniques by tactic:

Remediation

Immediate actions

Block crp2026.online, vpfinal142.myvnc.com and 45.146.81.142 (port 4782) at DNS, proxy and firewall
Quarantine or strip inbound .xhtml, .svg and .html attachments with court/fiscalía-themed subjects at the mail gateway
Hunt endpoints for SvcConfigZNn4r6.vbs, index_ZNn4r6.xhtml and Startup-folder shortcuts pointing to .vbs files

Workarounds

Open .svg and .xhtml files in a text viewer by default instead of the browser
Block execution of .js and .vbs files from user-writable paths and the Startup folder via application control
Block dynamic-DNS domains (for example myvnc.com) where not business-required

Longer-term hardening

Alert on wscript.exe/cscript.exe spawning powershell.exe and on in-memory .NET assembly loading via Reflection
Enable PowerShell Script Block Logging and AMSI/ETW tamper telemetry in EDR
Train judicial, fiscal, administrative and education staff on court-notice phishing

Affected and fixed versions

Microsoft — Windows (user endpoints; JScript/VBScript via Windows Script Host, PowerShell, .NET Framework 4.8)
Vulnerable versions: Not version-specific; user-execution based

Timeline

2025-12-16 Zscaler ThreatLabz publishes analysis of an earlier Blind Eagle campaign using an SVG-based fake Colombian judicial portal, the Caminho downloader and DCRat.
2026-10-21 Judicial query pages in the campaign (identifier GTH2026) generated on 21 October 2026, per Zenox.
2026-10-27 Further query pages generated and HTTP headers captured on 27 October 2026 (further captures 30 October).
2026-11-01 Zenox collects its capture set for the campaign, which it analyzed in controlled lab VMs.
2026-11-04 Zenox publishes 'Last Heist: New APT-C-36 Infection Wave in LatAm' and attributes the wave to APT-C-36 with high confidence.
2026-11-10 The Hacker News reports the campaign, noting no evidence of successful attacks against real-world targets.

Sources cited

Eventus Security Advisory - SVG attachment delivers AsyncRAT in Colombian judicial phishing campaign advisory.eventussecurity.com · Advisory
Zenox - Last Heist: New APT-C-36 Infection Wave in LatAm zenox.ai · Research · 2026-11-04
Zscaler ThreatLabz - BlindEagle Targets Colombian Government Agency with Caminho and DCRAT zscaler.com · Research · 2025-12-16
Acronis TRU - Shadow Vector targets Colombian users via privilege escalation and court-themed SVG decoys acronis.com · Vendor report
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America The Hacker News · News · 2026-11-10
SC Media - AsyncRAT spread through malicious SVG files imitating web portals scworld.com · News

Drafted by the Threadlinqs research pipeline from 6 sources; published 2026-11-10; last updated —.

Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America

Key facts

Detection coverage

Free detection: Blind Eagle APT-C-36 JavaScript Dropper Run by Windows Script Host from Archive/Download Path

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise

Sample indicators (3 of 16)

Technical analysis

Collection

Discovery

Defense Evasion

Execution

Privilege Escalation

Persistence

defense-impairment

Initial Access

Command and Control

Remediation

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline

Sources cited

Latest Threats

🔄 Threat Comparison

Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America

Key facts

Detection coverage

Free detection: Blind Eagle APT-C-36 JavaScript Dropper Run by Windows Script Host from Archive/Download Path

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise

Sample indicators (3 of 16)

Technical analysis

Collection

Discovery

Defense Evasion

Execution

Privilege Escalation

Persistence

defense-impairment

Initial Access

Command and Control

Remediation

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline

Sources cited

More in malware

Latest Threats

🔄 Threat Comparison