{"id":"CMP-202611-2djbn6","kind":"campaign","aliases":[],"related":[],"title":"Blind Eagle (APT-C-36) sends fake Colombian court and prosecutor notices in Spanish and Portuguese that install an AsyncRAT/DCRat-based remote-access trojan on Windows (ZenoX)","description":null,"summary":"ZenoX (report 4 Nov 2026, covered by The Hacker News 10 Nov) documents a new phishing wave by Blind Eagle (APT-C-36), run from a Brazilian operator cluster, targeting Latin American justice, public-administration and education organizations, especially staff who handle court cases, contracts and official notices. Emails in Spanish and Portuguese imitate court notifications, Fiscalía (Attorney General) notices, tutela proceedings and administrative circulars. The attachment is an SVG disguised as an XHTML file that shows a fake Fiscalía General de la Nación case-lookup page, builds a password-protected ZIP inside the browser (HTML smuggling, so email gateways never see it), and the ZIP holds a JavaScript dropper posing as 'Network Configuration Auditor v2.7.298'. A VBS stage bypasses AMSI/ETW, shows a decoy 'CITACION PENAL, FISCALIA' page, sets up Startup-folder persistence, and PowerShell loads an AsyncRAT fork with DCRat lineage in memory (hidden desktop, keylogger, screen capture, document theft). ZenoX analyzed 12 lure emails; it has no evidence of confirmed victims. Start date of the wave: unknown (report dated 4 Nov 2026).","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Emails in Spanish or Portuguese posing as court, Fiscalía, tutela or administrative notices with an .xhtml/.svg attachment, e.g. '43262 CONSTANCIA-Despacho.COL.97-126.xhtml' (~4.2 MB), or asking you to open a password-protected file (passwords seen: 9221, GTH2026)\n- Downloaded ZIPs named like Demanda_Ejecutiva_*__EXP2026-XXXX.zip; a script presenting itself as 'Network Configuration Auditor v2.7.298'; a decoy page titled 'CITACION PENAL, FISCALIA'\n- On Windows hosts: %APPDATA%\\Microsoft\\index_<random>.xhtml (seen: index_ZNn4r6.xhtml), a matching copy under C:\\Users\\Public\\, and a Startup-folder shortcut to SvcConfig<random>.vbs (seen: SvcConfigZNn4r6.vbs)\n- Network: crp2026[.]online (behind Cloudflare 104.21.16.229, 172.67.216.190), vpfinal142.myvnc[.]com, 45.146.81.142 (ports 4782, 5357, 5985)\n- Note: SPF/DKIM/DMARC passed on one lure, so passing checks do not make the message real\n- File hashes: not published in full (prefixes only)","fix":"- Do not open .xhtml/.svg attachments claiming to be court or prosecutor notices; confirm any case through the court's or Fiscalía's official portal reached by typing the address yourself\n- Block or quarantine inbound SVG/XHTML/HTML attachments at the mail gateway and stop wscript/cscript from running .js/.vbs files opened from Downloads or ZIPs\n- Block crp2026[.]online, vpfinal142.myvnc[.]com and 45.146.81.142\n- If a host matches the indicators: isolate it, remove the Startup shortcut and staged files, and reset passwords used on it","status":"open","published_at":null,"first_seen_at":"2026-11-10T16:01:15+00:00","triaged_at":"2026-11-10T16:01:15+00:00","updated_at":"2026-11-10T16:01:59+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-10T16:03:48Z","path":"phishing","entry":"social-engineering","reason":"The record describes deceptive court and Fiscalía notice emails that lure staff into opening a disguised attachment and enabling a password-protected ZIP, though it notes no confirmed victims and gives no start date.","confidence":0.5}},"analyst_status":"done","analyst_note":null,"search":"'-2':31A '-202611':30A '10':47B '12':195B '2026':41B,215B '36':6A,60B '4':39B,213B 'access':24A 'administr':73B,102B 'american':69B 'amsi/etw':161B 'analyz':194B 'apt':4A,58B 'apt-c':3A,57B 'asyncrat':179B 'asyncrat/dcrat-based':21A 'attach':105B 'attorney':96B 'auditor':155B 'blind':1A,55B 'brazilian':64B 'browser':135B 'build':127B 'bypass':160B 'c':5A,59B 'campaign':33B 'captur':190B 'case':82B,124B 'case-lookup':123B 'circular':103B 'citacion':165B 'cluster':66B 'cmp':29A 'colombian':9A 'configur':154B 'confirm':203B 'contract':83B 'court':10A,81B,93B 'cover':42B 'date':206B,212B 'dcrat':182B 'de':120B 'decoy':164B 'desktop':187B 'disguis':109B 'djbn6':32A 'document':49B,191B 'dropper':150B 'eagl':2A,56B 'earli':35B 'early-warn':34B 'educ':75B 'email':87B,139B,197B 'especi':77B 'evid':201B 'fake':8A,117B 'file':113B 'fiscalia':167B 'fiscalía':95B,118B 'folder':173B 'fork':180B 'gateway':140B 'general':97B,119B 'hacker':45B 'handl':80B 'hidden':186B 'hold':147B 'html':136B 'imit':92B 'insid':133B 'instal':19A 'javascript':149B 'justic':70B 'keylogg':188B 'la':121B 'latin':68B 'lineag':183B 'load':177B 'lookup':125B 'lure':196B 'memori':185B 'nación':122B 'network':153B 'never':141B 'new':51B 'news':46B 'notic':13A,86B,98B 'notif':94B 'nov':40B,48B,214B 'offici':85B 'oper':65B 'organ':76B 'page':126B,168B 'password':130B 'password-protect':129B 'penal':166B 'persist':174B 'phish':52B 'portugues':17A,91B 'pose':151B 'powershel':176B 'proceed':100B 'prosecutor':12A 'protect':131B 'public':72B 'public-administr':71B 'remot':23A 'remote-access':22A 'report':38B,211B 'run':61B 'screen':189B 'see':142B 'send':7A 'set':169B 'show':115B,162B 'smuggl':137B 'spanish':15A,89B 'staff':78B 'stage':159B 'start':205B 'startup':172B 'startup-fold':171B 'svg':108B 'target':67B 'theft':192B 'trojan':25A 'tutela':99B 'unknown':210B 'v2.7.298':156B 'vbs':158B 'victim':204B 'warn':36B 'wave':53B,209B 'window':27A 'xhtml':112B 'zenox':28A,37B,193B 'zip':132B,146B","nicknames":["Blind Eagle","APT-C-36","LAST HEIST"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["aptc36","blindeagle","lastheist"],"ptokens":[],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"phishing","search_a":"'-2':31A '-202611':30A '36':6A 'access':24A 'apt':4A 'apt-c':3A 'asyncrat/dcrat-based':21A 'blind':1A 'c':5A 'cmp':29A 'colombian':9A 'court':10A 'djbn6':32A 'eagl':2A 'fake':8A 'instal':19A 'notic':13A 'portugues':17A 'prosecutor':12A 'remot':23A 'remote-access':22A 'send':7A 'spanish':15A 'trojan':25A 'window':27A 'zenox':28A","search_b":"'10':47B '12':195B '2026':41B,215B '36':60B '4':39B,213B 'administr':73B,102B 'american':69B 'amsi/etw':161B 'analyz':194B 'apt':58B 'apt-c':57B 'asyncrat':179B 'attach':105B 'attorney':96B 'auditor':155B 'blind':55B 'brazilian':64B 'browser':135B 'build':127B 'bypass':160B 'c':59B 'campaign':33B 'captur':190B 'case':82B,124B 'case-lookup':123B 'circular':103B 'citacion':165B 'cluster':66B 'configur':154B 'confirm':203B 'contract':83B 'court':81B,93B 'cover':42B 'date':206B,212B 'dcrat':182B 'de':120B 'decoy':164B 'desktop':187B 'disguis':109B 'document':49B,191B 'dropper':150B 'eagl':56B 'earli':35B 'early-warn':34B 'educ':75B 'email':87B,139B,197B 'especi':77B 'evid':201B 'fake':117B 'file':113B 'fiscalia':167B 'fiscalía':95B,118B 'folder':173B 'fork':180B 'gateway':140B 'general':97B,119B 'hacker':45B 'handl':80B 'hidden':186B 'hold':147B 'html':136B 'imit':92B 'insid':133B 'javascript':149B 'justic':70B 'keylogg':188B 'la':121B 'latin':68B 'lineag':183B 'load':177B 'lookup':125B 'lure':196B 'memori':185B 'nación':122B 'network':153B 'never':141B 'new':51B 'news':46B 'notic':86B,98B 'notif':94B 'nov':40B,48B,214B 'offici':85B 'oper':65B 'organ':76B 'page':126B,168B 'password':130B 'password-protect':129B 'penal':166B 'persist':174B 'phish':52B 'portugues':91B 'pose':151B 'powershel':176B 'proceed':100B 'protect':131B 'public':72B 'public-administr':71B 'report':38B,211B 'run':61B 'screen':189B 'see':142B 'set':169B 'show':115B,162B 'smuggl':137B 'spanish':89B 'staff':78B 'stage':159B 'start':205B 'startup':172B 'startup-fold':171B 'svg':108B 'target':67B 'theft':192B 'tutela':99B 'unknown':210B 'v2.7.298':156B 'vbs':158B 'victim':204B 'warn':36B 'wave':53B,209B 'xhtml':112B 'zenox':37B,193B 'zip':132B,146B","search_c":"","cause_entry":"social-engineering","cause_path":"phishing","disclosures_checked_at":null,"first_public_at":"2026-11-04T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-2djbn6","url":"https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T16:01:15+00:00","fetched_at":"2026-11-10T16:01:15+00:00","note":null,"cites":["https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/"]}],"documents":[{"id":116046,"url":"https://x.com/TheHackersNews/status/2120184483542663507","title":"@TheHackersNews: ⚠️ Blind Eagle is targeting Latin American organizations with fake court notices","kind":"post","source":"x","publisher":null,"text":"⚠️ Blind Eagle is targeting Latin American organizations with fake court notices that deliver an AsyncRAT-based trojan.\n\nThe campaign uses weaponized SVG files, HTML smuggling, and in-memory execution to evade detection.\n\nInside the attack chain: https://t.co/XnV2mUVYh6\n\nlikes 16 reposts 4","published_at":"2026-11-10T15:59:06+00:00","relation":"describes","confidence":null,"note":null},{"id":116047,"url":"https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/","title":"LAST HEIST: New APT-C-36 infection wave in LATAM (ZenoX)","kind":"blog","source":"analyst","publisher":null,"text":"ZenoX report: APT-C-36 (Blind Eagle) judicial/administrative-themed phishing in Portuguese and Spanish (court notifications, fiscalía notices, tutela proceedings). Attachment 43262 CONSTANCIA-Despacho.COL.97-126.xhtml (SVG disguised as XHTML) renders fake Fiscalía General de la Nación 'Consultas' page; HTML smuggling builds password-protected ZipCrypto ZIP Demanda_Ejecutiva_*__EXP2026-XXXX.zip; JS dropper posing as Network Configuration Auditor v2.7.298; VBS with AMSI/ETW bypass, decoy page CITACION PENAL, FISCALIA; persistence %APPDATA%\\Microsoft\\index_<random>.xhtml, copy in C:\\Users\\Public\\, Startup shortcut SvcConfig<random>.vbs; PowerShell loads in-memory AsyncRAT fork with DCRat lineage (hidden desktop, keylogger, screen capture). Infra: distribution crp2026[.]online behind Cloudflare (104.21.16.229, 172.67.216.190); C2 vpfinal142.myvnc[.]com -> 45.146.81.142 (ports 4782, 5357, 5985). Targets justice, public administration, education. Brazilian operator cluster.","published_at":"2026-11-04T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}