# Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America

> Blind Eagle (APT-C-36) is running a phishing campaign with Spanish and Portuguese court and fiscalía-themed lures. It uses SVG/XHTML HTML smuggling, a JavaScript dropper, an AMSI/ETW-bypassing VBScript and in-memory PowerShell to deploy a RAT forked from AsyncRAT with DCRat lineage. Targets are judicial, fiscal, administrative and educational organizations in Latin America.

- **Published:** 2026-11-10T17:09:03Z
- **Last reviewed:** 2026-11-10T17:09:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5664
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5664.png
- **ID:** TL-2026-5664
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT-C-36
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

Zenox (report 'Last Heist: New APT-C-36 Infection Wave in LatAm', 4 November 2026, covered by The Hacker News on 10 November 2026) documents a new Blind Eagle (APT-C-36) infection wave. The initial lure is an email attachment, for example '43262 CONSTANCIA-Despacho.COL.97-126.xhtml' (about 4.2 MB), which is an SVG disguised as XHTML. It renders a fake Fiscalía General de la Nación page (display title 'CITACION PENAL, FISCALIA'; lure themes include tutela proceedings and administrative circulars). The page assembles a ZipCrypto-encrypted ZIP locally in the browser (HTML smuggling), with the password shown on the page. The ZIP (Demanda_Ejecutiva_*__EXP2026-XXXX.zip) holds a JavaScript dropper that displays itself as 'Network Configuration Auditor v2.7.298'.

The JavaScript dropper creates Scripting.FileSystemObject and WScript.Shell objects, performs environment reconnaissance (environment variables, registry values such as install date, network profile, product name and physical memory, and multilingual English/Portuguese/Spanish directory enumeration of Downloads, Desktop and Documents), then decodes and chains stages 3, 4 and 5. It deletes the original XHTML and removes the Mark-of-the-Web (Zone.Identifier). Stage 5 is a VBScript that bypasses AMSI and ETW, stores the encrypted payload in environment variables, creates a reversed fake XHTML copy (index_ZNn4r6.xhtml under %APPDATA%\Microsoft\), an auxiliary copy under C:\Users\Public\, and a Startup-folder shortcut targeting SvcConfigZNn4r6.vbs for persistence. Stage 6 is PowerShell that decodes the payload (AES-256-ECB, custom Base85, GZIP) and loads an x64 RAT in memory through Reflection and delegates; no final payload is written to disk.

The RAT is a PE64 DLL written in VB.NET (.NET Framework 4.8) with obfuscation, virtualization and modified build information. Zenox classifies it, with high confidence, as an AsyncRAT fork derived from DCRat (classes Client.Settings, CryptoCore, Aes256, MutexControl, Packet, MsgPack, ProcessCritical, IdSender; development markers Boss/Client77). Named capabilities are a hidden desktop (CreateDesktopW), keylogging (GetKeyboardLayout/ToUnicodeEx), screen capture (d3d11), video streaming (MFPlat), token impersonation and input blocking (BlockInput). Configuration fields (Hosts, Ports, Version, Key, MTX, Certificate) are redacted in the report. C2 is the dynamic-DNS host vpfinal142.myvnc.com (45.146.81.142, port 4782); lure distribution is via crp2026.online behind Cloudflare.

Attribution: Zenox attributes the activity to APT-C-36 with high confidence and to a Brazilian operational cluster (Portuguese lures and code references, hosting in Cotia, Brazil on ASN 265919, America/Sao_Paulo timezone). Blind Eagle is a Spanish-speaking group active since 2018 that has historically used commodity RATs (AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, Remcos). Caveats from the sources: Zenox executed the chain only in controlled lab VMs and observed no privilege escalation or lateral movement; The Hacker News states there is no evidence the attacks have succeeded against real-world targets; and the published report withholds full hashes, mutex, ZIP password and keys. The related Zscaler ThreatLabz report (16 December 2025) on an earlier Blind Eagle campaign (SVG judicial portal, Caminho downloader, DCRat) provides corroborating context for the actor's SVG/DCRat tradecraft.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1027.006 HTML Smuggling
- T1027.017 SVG Smuggling
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1553.005 Mark-of-the-Web Bypass
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1134.001 Token Impersonation/Theft
- T1082 System Information Discovery
- T1012 Query Registry
- T1056.001 Keylogging
- T1113 Screen Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1573.001 Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Blind Eagle APT-C-36 JavaScript Dropper Run by Windows Script Host from Archive/Download Path** (`TL-2026-5664-SPL-001`)

TL-2026-5664: detects wscript.exe/cscript.exe executing a .js file from a ZIP extraction folder (Temp1_*), the user Downloads folder or Temp, or referencing the campaign's Demanda_Ejecutiva_* ZIP / 'Network Configuration Auditor v2.7.298' masquerade. This is the stage-2 JavaScript dropper (T1059.007, T1204.002) opened after the HTML/SVG-smuggled ZIP from a Fiscalia-themed phishing lure (T1566.001) is extracted. Script hosts running .js directly from user-writable archive paths are rare in managed estates and are a strong behaviour-first signal independent of changing filenames or hashes.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.007, T1566.001
- **Data sources:** sysmon, microsoft_defender_for_endpoint_DeviceProcessEvents, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\wscript.exe" OR Image="*\\cscript.exe") (CommandLine="*Temp1_*" OR CommandLine="*Demanda_Ejecutiva*" OR CommandLine="*Network Configuration Auditor*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\AppData\\Local\\Temp\\*") | where match(CommandLine, "(?i)[.]jse?([^a-z0-9]|$)") | eval parent_class=if(match(ParentImage, "(?i)(explorer|7zfm|7zg|winrar|winzip)[.]exe$"), "archive_or_shell", "other") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(parent_class) as parent_class by host, User, ParentImage, Image | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine matches regex @"(?i)[.]jse?([^a-z0-9]|$)"
| where ProcessCommandLine has_any ("Temp1_", "Demanda_Ejecutiva", "Network Configuration Auditor", "Downloads")
| extend ParentClass = iff(InitiatingProcessFileName in~ ("explorer.exe", "7zFM.exe", "7zG.exe", "WinRAR.exe"), "archive_or_shell", "other")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ParentClass
| order by Timestamp desc
```

### Sigma

```yaml
title: Script Host Executing JavaScript From Archive or Download Path - Blind Eagle TL-2026-5664
id: 8d3e1c52-6a47-4b19-a0f3-5e2b7c9d4a11
status: experimental
description: Detects wscript.exe or cscript.exe running a .js file from a ZIP extraction folder (Temp1_), the Downloads folder, or referencing the Blind Eagle Demanda_Ejecutiva ZIP / Network Configuration Auditor masquerade (stage-2 JavaScript dropper).
references:
  - https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/
  - https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html
author: Threadlinqs Team
date: 2026/11/10
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_path:
    CommandLine|contains:
      - 'Temp1_'
      - 'Demanda_Ejecutiva'
      - 'Network Configuration Auditor'
      - '\Downloads\'
  selection_js:
    CommandLine|contains: '.js'
  condition: selection_img and selection_path and selection_js
falsepositives:
  - Administrators or developers running legitimate .js maintenance scripts from Downloads
  - Software installers that unpack JScript helpers into Temp
level: high
```

**Known false positives:**

- Administrators or developers running legitimate .js maintenance scripts from the Downloads folder
- Software installers that unpack JScript helper scripts into Temp during installation

**Tuning notes:** Replace index=sysmon with the index that holds Sysmon EventCode 1 in your environment. Allow-list signed internal admin scripts by hash or path. If Windows Script Host is blocked by policy for .js, raise to critical and drop the Downloads/Temp path filter to alert on every script-host .js execution.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Blind Eagle HTML/SVG-Smuggled ZIP and Fiscalia-Themed XHTML Lure Written to Disk (locked: unlock with TL Creds)
- Blind Eagle Script Host Spawning PowerShell for In-Memory RAT Staging (locked: unlock with TL Creds)
- Blind Eagle Dynamic-DNS Egress from Script Hosts and PowerShell (locked: unlock with TL Creds)
- Blind Eagle Nested Script-Host Chain (JavaScript Dropper to VBScript Stage) (locked: unlock with TL Creds)
- Blind Eagle PowerShell AMSI/ETW Tampering and In-Memory .NET Assembly Load (locked: unlock with TL Creds)
- Blind Eagle Lure Distribution Domain [indicator] Access (locked: unlock with TL Creds)
- Blind Eagle Startup-Folder VBScript Shortcut Persistence (SvcConfigZNn4r6 / index_ZNn4r6) (locked: unlock with TL Creds)
- Blind Eagle RAT C2 Connection or DNS Lookup ([indicator] / [indicator]:4782) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- IP address: `45.146.81[.]142`
- Domain: `crp2026[.]online`
- File hash: `e7666af17732e9a3954f6308bc52866b937ac67099faa212518d5592baca5d44`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America](https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html)
- [Zenox - Last Heist: New APT-C-36 Infection Wave in LatAm](https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/)
- [Zscaler ThreatLabz - BlindEagle Targets Colombian Government Agency with Caminho and DCRAT](https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat)
- [Acronis TRU - Shadow Vector targets Colombian users via privilege escalation and court-themed SVG decoys](https://www.acronis.com/en-us/cyber-protection-center/posts/shadow-vector-targets-colombian-users-via-privilege-escalation-and-court-themed-svg-decoys/)
- [Eventus Security Advisory - SVG attachment delivers AsyncRAT in Colombian judicial phishing campaign](https://advisory.eventussecurity.com/advisory/svg-attachment-delivers-asyncrat-in-colombian-judicial-phishing-campaign)
- [SC Media - AsyncRAT spread through malicious SVG files imitating web portals](https://www.scworld.com/news/asyncrat-spread-through-malicious-svg-files-imitating-web-portals)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5664