New Spear Phishing Attack Leveraging Argentine Federal Court Rulings to Covert RAT for Remote Access
## Cybersecurity: Spear-Phishing Campaign Targets Argentine Judicial Sector
Cybersecurity: Spear-Phishing Campaign Targets Argentine Judicial Sector
A recent spear-phishing campaign has been identified targeting Argentina's judicial sector. This attack exploits trust in genuine court communications to deliver a Remote Access Trojan (RAT).
The campaign involves the distribution of federal court documents related to preventive detention reviews, aiming to deceive legal professionals into downloading malicious software. Security experts have noted its highly targeted nature, using multi-stage infection techniques to access sensitive systems.
The process starts with emails containing a ZIP archive, appearing as an official judicial notice. Within the archive, a Windows shortcut file is disguised as a PDF, accompanied by a batch script loader and what seems to be a legitimate court resolution document. When the recipient opens the PDF file, the malware execution chain is triggered while displaying a decoy document to avoid detection.
The malware uses a three-stage infection process for stealth. The weaponized LNK file initiates PowerShell in hidden mode, bypassing execution policies to run a batch script that connects to infrastructure hosted on GitHub.
A recent spear-phishing campaign has been identified targeting Argentina's judicial sector.
The batch script downloads a second-stage payload, disguised as "msedge_proxy.exe," stored within the Microsoft Edge user data directory for legitimacy. The final payload is a Rust-based RAT with extensive anti-analysis features.
The RAT conducts comprehensive environment checks before execution, searching for virtual machines, sandboxes, and debugging tools. If such tools are detected, the malware terminates to prevent analysis. Once operational, it establishes encrypted command-and-control communication, enabling attackers to perform actions such as file exfiltration, persistence installation, credential harvesting, and ransomware deployment through modular DLL components.
This campaign specifically targets Argentina's legal sector, including judicial institutions, legal professionals, and government bodies associated with the justice system. The decoy documents closely mimic authentic Argentine federal court resolutions, significantly increasing the campaign's effectiveness.
Based on reporting by Cyber Security News.