Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Spear-Phishing Campaign Abuses Argentine Federal Court Rulings to Deliver Covert RAT

Seqrite Labs has identified a spear-phishing campaign targeting the judicial sector in Argentina, utilizing a Rust-based Remote Access Trojan (RAT). The operation employs a multi-stage infection chain to infiltrate legal institutions and organizations.

ABy Aiden SinclairJan 21, 20261 min read

Seqrite Labs has identified a spear-phishing campaign targeting the judicial sector in Argentina, utilizing a Rust-based Remote Access Trojan (RAT). The operation employs a multi-stage infection chain to infiltrate legal institutions and organizations.

The campaign focuses on Argentina's judicial institutions, legal professionals, and related government and academic organizations. Attackers use legitimate Argentine court documents, such as preventive detention review documents, to enhance credibility and facilitate malware delivery.

Initial Vector: Spear-phishing emails containing a ZIP archive with three components: a malicious LNK file, a BAT-based loader script, and a judicial PDF decoy. Stage 1: The LNK file executes PowerShell with execution policy bypass and hidden window mode, disguising it as a legitimate document. Stage 2: The BAT loader connects to GitHub repositories to download the second-stage payload, using spoofed User-Agent strings. Stage 3: Deploys the primary RAT component, performing anti-analysis checks and establishing communication with a command and control (C2) server.

The decoy document appears as an Argentine federal court resolution, complete with case numbers, judicial signatures, and procedural language. Its structure closely mirrors authentic court rulings to increase the likelihood of user interaction.

Command Set: Includes commands for persistence, file operations, credential theft, ransomware functionality, and privilege escalation. Persistence Techniques: Utilizes registry Run keys and scheduled tasks with randomized names to maintain access. Anti-Analysis Checks: Detects virtual machines, sandbox environments, and debuggers.

Organizations are advised to implement enhanced email filtering, disable LNK file execution from email sources, enforce PowerShell execution policies, and deploy endpoint detection and response solutions to identify suspicious process chains and C2 communications patterns.

Seqrite Labs has identified a spear-phishing campaign targeting the judicial sector in Argentina, utilizing a Rust-based Remote Access Trojan (RAT).
Aiden Sinclair · Thehackingpost

Hash Name / File Path C2 Server

dc802b8c117a48520a01c98c6c9587b5 info/juicio-grunt-posting.pdf.lnk

45f2a677b3bf994a8f771e611bb29f4f D:\auto_black_abuse\resources\unzipped\20251215_140518_2025-11-28\13adde53bd767d17108786bcc1bc0707c2411a40f11d67dfa9ba1a2c62cc5cf3.zip

02f85c386f67fac09629ebe5684f7fa0 info/health-check.bat

Advertisement

976b6fce10456f0be6409ff724d7933b \msedge_proxy.exe

233a9dbcfe4ae348c0c7f4c2defd1ea5 info/notas.pdf

— — 181.231.253.69:4444

Based on reporting by GBHackers.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026