Blind Eagle's Judicial Phishing Blitz Delivers AsyncRAT in Latin America

Blind Eagle, a Spanish-speaking APT group operating since 2018, launched a large-scale phishing campaign targeting judicial, fiscal, and administrative organizations across Latin America. The group spoofed official court notices and attorney general communications in Portuguese and Spanish to trick employees into opening weaponized attachments. Nearly 3,300 malicious emails were observed during a two-week span in late October and early November 2026, with Colombia as the primary target.

The attack chain layered multiple evasion techniques to bypass email security. An XHTML file containing an SVG image employed HTML smuggling to assemble a ZIP archive locally in the browser without triggering filters. The archive contained a JavaScript dropper posing as legitimate auditing software, which performed reconnaissance before launching a Visual Basic script that disabled antimalware scanning and event tracing. PowerShell then executed an AsyncRAT variant with DCRat ancestry, establishing persistence through the Windows Startup folder.

The campaign reflects broader regional vulnerabilities in infrastructure security. By targeting organizations controlling sensitive legal and financial records, the group gains access to classified information while exploiting uneven security maturity across public and private sectors. Researchers attributed the operation to a Brazilian-based cluster within APT-C-36, noting that Colombia’s structural security gaps, combined with regional threat actors’ familiarity with local systems, create conditions for successful compromises and credential harvesting.