Blind Eagle's Fake Colombian Court Notices Build the Malware Inside Your Browser, So the Mail Filter Never Sees It. Three Indicators From ZenoX Are Now in Our Feed
If your organization receives court, prosecutor or tutela notices by email, in Colombia or anywhere in Latin America, block these three now: the address 45.146.81.142, the host vpfinal142.myvnc.com and the domain crp2026.online. Then make Windows open .js, .vbs and .xhtml/.svg attachments in Notepad instead of running or rendering them, and tell the people who handle legal mail that a notice which asks them to open a ZIP and run a "Network Configuration Auditor" is the attack.
What the research says
The primary source is ZenoX, a Brazilian threat-intelligence firm, in its report "LAST HEIST: New APT-C-36 infection wave in LATAM," published November 4, 2026. We read it in full. The Hacker News covered it on November 10.
Who: ZenoX attributes the wave to APT-C-36, also called Blind Eagle, a group that has targeted Colombian government and companies since 2018. ZenoX rates the attribution high confidence and adds a separate hypothesis that the operators are Brazilian, based on hosting in Cotia, Brazilian network 265919, a São Paulo server time zone and Portuguese in the code and lures. ZenoX says that hypothesis does not identify a person.
The lure: emails styled as court notifications, fiscalía notices, tutela proceedings and administrative circulars, in Spanish and Portuguese, sent to people who handle cases, contracts and formal notices in justice, public administration and education. One attachment ZenoX analyzed was named "43262 CONSTANCIA-Despacho.COL.97-126.xhtml."
The trick: the attachment is an SVG image disguised as an XHTML page. Opened in a browser, it shows a fake query page of Colombia's Fiscalía General de la Nación and builds a password-protected ZIP inside the browser. Because the ZIP is assembled on the victim's machine, the email gateway never sees it. This technique is called HTML smuggling.
The chain: the ZIP holds a JavaScript file posing as "Network Configuration Auditor v2.7.298," which collects system details and launches a VBScript. That script disables two Windows inspection features (AMSI and ETW), shows a fake "CITACION PENAL, FISCALIA" page as a distraction, deletes the original attachment, strips the Windows "downloaded from the internet" mark, and adds a shortcut to the Startup folder. PowerShell then decodes the final program and runs it in memory without writing it to disk.
The payload: a remote-access program ZenoX classifies as a fork of AsyncRAT derived from DCRat. In ZenoX's lab it ran a hidden desktop, logged keystrokes, captured the screen, impersonated the user's session and could block the user's keyboard and mouse.
Dates: fake query pages generated October 21 and 27; email headers dated October 27 and 30; ZenoX's captures collected November 1.
What the numbers count
ZenoX's report is built from 12 fraudulent emails it collected, plus the archives and scripts they led to. ZenoX says that set "cannot estimate the total reach of the wave." The Hacker News reports about 3,300 malicious emails; we did not find that figure in the English version of ZenoX's report we read, so we cannot say what it counts. ZenoX also says it saw no evidence of a successful compromise at a real organization: everything after the click was observed in ZenoX's own virtual machines.
What we added to our feed, and what we left out
ZenoX publishes three indicators. We hold none of them before today: our correlation lookup returned not held, with no neighbors in our data, for all three. We added them with actor "Blind Eagle," confidence 80, under source manual-batch-blind-eagle-last-heist:
45.146.81.142, the command server. ZenoX calls it the most specific finding, a dedicated Windows machine with port 4782 used for command traffic, plus 5357 and 5985 (Windows remote management) open.
vpfinal142.myvnc.com, the command host name. myvnc.com is a free dynamic-DNS service used by many people, so we list only this one host name, not myvnc.com.
crp2026.online, the distribution domain, about five weeks old per ZenoX.
Left out on purpose: the two addresses crp2026.online resolves to (104.21.16.229 and 172.67.216.190) belong to Cloudflare's shared network, and ZenoX itself says they must not be treated as the operator's; blocking them would block unrelated sites. ZenoX published only the first few characters of three file hashes and withheld the full hashes, so there is no hash to add. ZenoX also notes these addresses were active during its analysis and should be rechecked before a takedown; a dynamic-DNS name can be moved to a new address in minutes.
What to do
Block the three indicators above at your mail gateway, web proxy and firewall, and search the last 30 days of DNS and proxy logs for vpfinal142.myvnc.com, crp2026.online and connections to 45.146.81.142, especially on port 4782.
Set Windows to open .js, .jse, .vbs and .wsf files in Notepad, so double-clicking a script does not run it. Most staff never need to run a script from an email.
Treat .svg, .xhtml and .html attachments from outside as high risk. Quarantine or strip them at the mail gateway if your business does not need them.
On endpoints, alert on wscript.exe or cscript.exe launching PowerShell, new .vbs shortcuts in the Startup folder, and .xhtml files under the user's AppData\Roaming\Microsoft folder or in C:\Users\Public.
Tell staff who handle legal and administrative mail: real courts and prosecutors do not deliver notices as a ZIP with a password shown on a web page.
What is not known
Whether any organization was actually compromised in this wave, how many messages were sent and to how many organizations, and what the full file hashes are. The attribution to Blind Eagle is ZenoX's assessment; we did not test it.
How we know, and how we checked
We read ZenoX's report and The Hacker News article. We checked all three indicators against our own data before adding them (none held, no neighbors), and wrote them with a verified write that reads each record back. We then downloaded our published blocklists and confirmed the address is in ips.csv and both names are in domains.csv. We searched our own edge for the command address: our edge-shield blocks (281,160 records), edge decoys (96,502) and origin honeypot (2,276) held no request from 45.146.81.142 since September 1. That is expected, since this is a phishing campaign aimed at mailboxes, not a scan of web servers, so our edge is not where it would show up. We make no claim that we saw this campaign before ZenoX did.
Sources
ZenoX, "LAST HEIST: New APT-C-36 infection wave in LATAM," November 4, 2026 (zenox.ai). The Hacker News, "Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America," Ravie Lakshmanan, November 10, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments