--- id: "CMP-202611-2djbn6" page: "https://infrastack.ai/live/CMP-202611-2djbn6" kind: "campaign" aliases: [] title: "Blind Eagle (APT-C-36) sends fake Colombian court and prosecutor notices in Spanish and Portuguese that install an AsyncRAT/DCRat-based remote-access trojan on Windows (ZenoX)" severity: "medium" cvss: null epss: null exploited: false status: "open" category: "other" products: [] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-10T16:01:15+00:00" updated_at: "2026-11-10T16:01:59+00:00" sources: [{"source": "analyst", "url": "https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/", "first_seen_at": "2026-11-10T16:01:15+00:00", "cites": ["https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/"]}] exploit_sources: [] --- # Blind Eagle (APT-C-36) sends fake Colombian court and prosecutor notices in Spanish and Portuguese that install an AsyncRAT/DCRat-based remote-access trojan on Windows (ZenoX) Link for people: https://infrastack.ai/live/CMP-202611-2djbn6 (this .md is for agents) ZenoX (report 4 Nov 2026, covered by The Hacker News 10 Nov) documents a new phishing wave by Blind Eagle (APT-C-36), run from a Brazilian operator cluster, targeting Latin American justice, public-administration and education organizations, especially staff who handle court cases, contracts and official notices. Emails in Spanish and Portuguese imitate court notifications, Fiscalía (Attorney General) notices, tutela proceedings and administrative circulars. The attachment is an SVG disguised as an XHTML file that shows a fake Fiscalía General de la Nación case-lookup page, builds a password-protected ZIP inside the browser (HTML smuggling, so email gateways never see it), and the ZIP holds a JavaScript dropper posing as 'Network Configuration Auditor v2.7.298'. A VBS stage bypasses AMSI/ETW, shows a decoy 'CITACION PENAL, FISCALIA' page, sets up Startup-folder persistence, and PowerShell loads an AsyncRAT fork with DCRat lineage in memory (hidden desktop, keylogger, screen capture, document theft). ZenoX analyzed 12 lure emails; it has no evidence of confirmed victims. Start date of the wave: unknown (report dated 4 Nov 2026). _Summary, check and fix written by a model from the sources; labelled as such._ ## Cause How the attacker got in: a person was tricked (social-engineering). The record describes deceptive court and Fiscalía notice emails that lure staff into opening a disguised attachment and enabling a password-protected ZIP, though it notes no confirmed victims and gives no start date. How it reached others: their users got messages abusing it (phishing). So it does not happen to you: Use phishing-resistant second factors on the accounts that matter, and never reset a factor on a phone call alone. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#phishing ## How to check - Emails in Spanish or Portuguese posing as court, Fiscalía, tutela or administrative notices with an .xhtml/.svg attachment, e.g. '43262 CONSTANCIA-Despacho.COL.97-126.xhtml' (~4.2 MB), or asking you to open a password-protected file (passwords seen: 9221, GTH2026) - Downloaded ZIPs named like Demanda_Ejecutiva_*__EXP2026-XXXX.zip; a script presenting itself as 'Network Configuration Auditor v2.7.298'; a decoy page titled 'CITACION PENAL, FISCALIA' - On Windows hosts: %APPDATA%\Microsoft\index_.xhtml (seen: index_ZNn4r6.xhtml), a matching copy under C:\Users\Public\, and a Startup-folder shortcut to SvcConfig.vbs (seen: SvcConfigZNn4r6.vbs) - Network: crp2026[.]online (behind Cloudflare 104.21.16.229, 172.67.216.190), vpfinal142.myvnc[.]com, 45.146.81.142 (ports 4782, 5357, 5985) - Note: SPF/DKIM/DMARC passed on one lure, so passing checks do not make the message real - File hashes: not published in full (prefixes only) ## Fix - Do not open .xhtml/.svg attachments claiming to be court or prosecutor notices; confirm any case through the court's or Fiscalía's official portal reached by typing the address yourself - Block or quarantine inbound SVG/XHTML/HTML attachments at the mail gateway and stop wscript/cscript from running .js/.vbs files opened from Downloads or ZIPs - Block crp2026[.]online, vpfinal142.myvnc[.]com and 45.146.81.142 - If a host matches the indicators: isolate it, remove the Startup shortcut and staged files, and reset passwords used on it ## Timeline - 2026-11-10T16:01:15+00:00 analyst https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/ ## Documents - [describes] @TheHackersNews: ⚠️ Blind Eagle is targeting Latin American organizations with fake court notices https://x.com/TheHackersNews/status/2120184483542663507 - [describes] LAST HEIST: New APT-C-36 infection wave in LATAM (ZenoX) https://zenox.ai/en/last-heist-new-apt-c-36-infection-wave-in-latam/ --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_