Executive Summary
A sophisticated phishing campaign, identified as COURT-ADR, is currently targeting more than 100,000 companies by impersonating the United States District Court, Southern District of Florida. Attackers use highly personalized emails containing unique Alternative Dispute Resolution (ADR) IDs that lead victims to a realistic, cloaked phishing portal. This portal serves password-protected ZIP archives containing ISO images, a technique used to bypass traditional email filters.
Technically, the campaign employs a multi-path execution chain using .msc, .bat, or .lnk files to download and execute LodaRAT, an AutoIt-based Remote Access Trojan. The malware is disguised as legitimate system processes like Taskmgr.exe or msedge.exe to stay under the radar. It establishes persistence through multiple mechanisms including scheduled tasks, registry Run keys, and a VBS watchdog script while communicating with C2 servers over cleartext TCP.
This threat is significant due to its massive scale and the high level of social engineering involved. LodaRAT provides attackers with full control over infected systems, including extensive credential theft from browsers and applications, keylogging, surveillance (webcam/microphone), and lateral movement capabilities. Organizations are advised to monitor for the specific infrastructure and file artifacts associated with this campaign immediately.