Threat video1:00
Blind Eagle APT-C-36 Court-Notice Lures: Detection & IOCs
Blind Eagle (APT-C-36) sends fake court notices to judicial and fiscal staff in Latin America. 9 detection rules, 16 IOCs and a free Splunk SPL rule.
Read the full threat intel for Blind Eagle APT-C-36 Court-Notice Lures: Detection & IOCs →
Chapters
- 0:00The hookCourt notices carry a RAT.
- 0:04The storyBlind Eagle targets judicial bodies.
- 0:10Attack pathA court notice starts it.
- 0:22AttributionAttributed to APT-C-36.
- 0:27Indicators of compromise13 indicators to hunt: 3 IPs, 3 domains and 3 SHA-256 hashes, and more.
- 0:36MITRE ATT&CK techniques22 ATT&CK techniques, from initial access to command and control.
- 0:41Remediation3 steps now: Block crp2026[.]online, vpfinal142[.]myvnc[.]com.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Court notices carry a RAT.
0:05Blind Eagle targets judicial bodies.
0:07Zenox documents it.
0:11A court notice starts it.
0:12A fake utility script runs.
0:14A RAT loads, then beacons out.
0:17It logs keys.
0:23Attributed to APT-C-36. Confidence: high.
0:2813 indicators to hunt: 3 IPs, 3 domains and 3 SHA-256 hashes, and more.
0:3622 ATT&CK techniques, from initial access to command and control.
0:423 steps now: Block crp2026[.]online, vpfinal142[.]myvnc[.]com.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.