Hackers Pose as Courts to Infect Latin American Firms

A hacking group is using fake court notices to deliver a remote access trojan to organizations across Latin America.

The cyber-espionage group known as Blind Eagle has launched a new phishing campaign targeting organizations across Latin America. According to reporting from The Hacker News, the attackers are sending emails that convincingly imitate official judicial and administrative notices. These messages, written in Spanish and Portuguese, use themes like court summons and fiscal proceedings to trick recipients into opening malicious attachments. The ultimate goal is to install a remote access trojan (RAT), a type of malware that gives the attackers complete control over the victim's computer.

The attack relies on a classic social engineering playbook that has been updated for regional specificity. An employee receives an email that appears to be an urgent legal matter from a government body, creating a sense of authority and immediacy. This pressure leads the user to click a link or open an attachment, which then triggers a multi-stage infection process. The malware delivered is a custom remote access trojan that shares characteristics with well-known tools like AsyncRAT and DCRat. Once installed, the RAT allows the Blind Eagle operators to execute commands, steal files, log keystrokes, and capture screenshots, effectively turning the compromised machine into a spy inside the target's network.

Blind Eagle is not a new player in the cybersecurity landscape. The Spanish-speaking group has been active for several years, primarily focusing its espionage efforts on public and private sector entities in South America, particularly in Colombia and Ecuador. While their tools and techniques are not always the most technically sophisticated, their strength lies in crafting highly effective, culturally and linguistically relevant lures. This latest campaign is a continuation of that strategy, demonstrating that a deep understanding of the target's environment can be more critical to success than developing zero-day exploits. The use of official government themes preys on the recipient's sense of civic duty or fear of legal trouble, making it a powerful and repeatable tactic.

For security teams and business leaders, this campaign serves as a crucial reminder that the human element remains a primary target for attackers. Technical controls like email filters and antivirus software are essential, but a well-designed phishing email can still slip through. Organizations with a presence in Latin America should immediately reinforce security awareness training, specifically warning employees about the tactics used in this campaign. The key defensive measure is procedural: employees must be taught to independently verify any unexpected official communication through a known, trusted channel before ever clicking a link. On the technical side, security teams should ensure their endpoint monitoring tools are tuned to detect the behaviors typical of a RAT, such as unusual network connections or processes attempting to gain persistence on a system.

This campaign highlights the effectiveness of highly localized social engineering. For security teams, it's a reminder that even known threat actors can successfully reuse simple but convincing lures, bypassing technical controls by targeting human trust. The use of a RAT derived from common tools complicates detection.

Organizations in Latin America face a direct threat of data theft and corporate espionage. A successful breach could lead to significant financial loss, reputational damage, and operational disruption as attackers gain full control over compromised systems and access sensitive company information.