[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f03y_tMUbjvO0bsehjCR1ytke9-MJK0EKnK2DXsLe_5s":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"b5b03001-de7c-4790-bc94-47cd60b6c527","blind-eagle-weaponizes-fake-court-notices-to-deploy-asyncrat-variant-across-latin-america","cd148051-e51b-433f-836f-7ea9db37ae20","Blind Eagle Weaponizes Fake Court Notices to Deploy AsyncRAT Variant Across Latin America","The Blind Eagle threat actor successfully exploited human trust in official-looking legal documents to deliver a sophisticated RAT payload through a multi-stage attack chain involving SVG files, HTML smuggling, JavaScript, and PowerShell. The root cause is insufficient user awareness of socially engineered phishing lures combined with inadequate endpoint controls that allow scripting languages like PowerShell and JavaScript to execute untrusted payloads. This matters because RATs grant attackers persistent remote access, enabling data theft, lateral movement, and long-term compromise. The use of SVG-based HTML smuggling is specifically designed to bypass traditional email and web gateway filtering, making technical defenses alone insufficient without educated end users who can spot suspicious attachments.","**Immediate actions:**\n- Train employees to verify the legitimacy of unsolicited court or administrative documents through official channels before opening any attachments.\n- Block or sandbox SVG and HTML file attachments at the email gateway, as these are uncommon legitimate business file types.\n- Apply PowerShell Constrained Language Mode and script block logging to limit and audit PowerShell execution on endpoints.\n\n**Long-term improvements:**\n- Deploy an endpoint detection and response (EDR) solution capable of detecting multi-stage dropper behavior, including JavaScript-to-PowerShell execution chains.\n- Implement application whitelisting to prevent unapproved scripts and executables from running, reducing the attack surface for droppers.\n- Conduct regular phishing simulation exercises tailored to regional lures (e.g., legal\u002Fcourt themes) to build employee resilience.\n\n**Detection measures:**\n- Monitor for anomalous PowerShell executions, especially those spawned from browser or email client processes.\n- Alert on outbound connections to unknown or newly registered domains initiated by scripting engines or office applications.\n- Establish baseline network behavior and flag unexpected RAT-associated traffic patterns such as persistent C2 beaconing.",[12,13,14,15,16],"CIS Control 14: Security Awareness and Skills Training (v8)","CIS Control 9: Email and Web Browser Protections (v8)","MITRE ATT&CK T1566.001: Phishing: Spearphishing Attachment","MITRE ATT&CK T1059.001: Command and Scripting Interpreter: PowerShell","NIS2 Article 21(2)(g)",{"NIS2 Article 21(2)(g)":18,"CIS Control 9: Email and Web Browser Protections (v8)":19,"MITRE ATT&CK T1566.001: Phishing: Spearphishing Attachment":20,"CIS Control 14: Security Awareness and Skills Training (v8)":21,"MITRE ATT&CK T1059.001: Command and Scripting Interpreter: PowerShell":22},"This point mandates basic cyber hygiene and training for staff, which would directly address the human susceptibility to official-looking phishing lures that enabled this campaign to succeed.","This control calls for filtering and blocking dangerous email attachment types and web content, which would have intercepted the weaponized SVG and HTML smuggling payloads before reaching end users.","Blind Eagle delivered the RAT through phishing emails with malicious SVG attachments disguised as court documents, directly matching this technique.","This control requires organizations to establish training programs that help users recognize phishing and social engineering lures, which is the primary attack vector Blind Eagle exploited with fake court notices.","The attack chain used PowerShell as a final-stage dropper mechanism, which this technique covers and which endpoint controls like Constrained Language Mode are designed to restrict.","published","2026-11-10T18:21:44.979086+00:00","2026-11-10T18:21:44.944+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fblind-eagle-uses-fake-court-notices-to.html","blind-eagle-uses-fake-court-notices-to-deliver-remote-access-trojan-across-latin-af8c1d","Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]