Fake Court Adr Phishing Lodarat

A phishing campaign impersonating a U.S. federal court targets more than 100,000 companies and delivers LodaRAT, a commodity remote access trojan.

Attackers impersonating the United States District Court, Southern District of Florida, are running a phishing campaign that targets companies with personalized emails, each containing a unique Alternative Dispute Resolution (ADR) ID.

The emails redirect targets to a fake court ADR portal ( florida[.]courtadr[.]com ) that serves a password-protected ZIP archive containing an ISO with three differently disguised files.

All three files deliver the same LodaRAT payload, rebuilt under three names ( SystemSettings.exe , Taskmgr.exe , and msedge.exe ) served from us[.]wind0ws[.]net and beaconing to my[.]thispc[.]net:4000 .

According to our research, more than 100,000 companies are targeted.

ThreatDown Endpoint Protection blocks the remote access trojan (RAT) samples and the campaign’s network communications.

Our research team recently investigated a campaign that is using the florida[.]courtadr[.]com website to distribute a commodity RAT known as LodaRAT .

Targets are approached through an email sent from Resolution@courtadr[.]com with the subject: Court-Ordered ADR Notice for – ADR ID: .

Here is an example of the email:

At the time of writing, the real Southern District of Florida court is aware of this phishing campaign and is alerting citizens through this official advisory .

Fake court ADR website

Once the target has clicked one of the links inside the email, a full website that pretends to be an official court-related ADR case portal is presented. The website only accepts Microsoft Edge as the browser.

The page in front of the target is personalized and reports details contained in the email message, such as company name , email address , and ADR ID . It invites the user to click the “Download Your Case File” button to obtain the “complete ZIP archive of your case file.”

To look realistic, the website has several pages containing a lot of court-related text and, more interestingly, has a function , through which the user can find cases using ADR IDs. We tried several different ADR ID values and noticed that the scope of this campaign is large: according to our research, more than 100,000 companies are targeted . Each target has its own ADR ID and its own personalized page, but they all end up serving the same ZIP archive.

The archive, aka “your case file”

After clicking the button to download the case file, the target receives a ZIP archive (named after the associated ADR ID, for example, 7_26-cv-04501-ADR.zip ), protected by a password. According to the website, the password is the associated ADR ID itself.

The archive contains a single ISO disk image file named Court_Order_for_ADR.iso .

After double-clicking this ISO file, a disk image with the label “Alternative Dispute Resolution A” is mounted, which contains three files:

Court_Order_for_ADR.msc

Original_Complaint.bat

Supporting-lawsuit-documents.lnk

All three files, if double-clicked, will deliver a small variant of the same malicious payload. More details in the following sections.

Path 1: Microsoft Management Console file

If Court_Order_for_ADR.msc is double-clicked, an administrative snap-in (similar to services.msc ) is executed by mmc.exe and shown on screen.

Once decoded, the powershell.exe command is:

A malicious payload called Taskmgr.exe is downloaded from us[.]wind0ws[.]net , dropped in the %APPDATA% folder, and executed immediately.

If Original_Complaint.bat is double-clicked, this command is executed by cmd.exe :

Once the caret characters are removed, the functionality is revealed. We summarize the important parts here:

eCHo devicecreDeNTIaldEPLoYMent ^& TIMeouT /T 7 /NObreak ^&^& TASkkILl.exe /F /IM RuNdLl32.exe written to %TMP%\wcUPX6UKGn6.BAt and launched -> Shows a fake full-screen “Device Credential Deployment” dialog for 7 seconds, then force-kills the rundll32.exe helper process to clean up.

Rundll32 inetcpl.cpl , ClearMyTracksByProcess 8 -> Clears Internet Explorer’s cached temporary internet files.

rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll" , ImageView_Fullscreen -> Downloads the SystemSettings.exe malicious payload into Internet Explorer’s cache.

FOR /F %%A In ('dir %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\ /s /b') do conhost %%A -> Finds the cached download and executes it via conhost.exe .

In this case the malicious payload is called SystemSettings.exe , downloaded once again from us[.]wind0ws[.]net and executed with conhost.exe .

Path 3: Shortcut file

If Supporting-lawsuit-documents.lnk is double-clicked, cmd.exe starts with this command line:

Once decoded, the powershell.exe command is:

A malicious payload called msedge.exe is downloaded from us[.]wind0ws[.]net , dropped in the %APPDATA% folder, and executed immediately.

Delivery paths summary

All three payloads are downloaded from us[.]wind0ws[.]net .

An AutoIt3 RAT in the LodaRAT family was found deployed under three disguises : SystemSettings.exe , Taskmgr.exe , and msedge.exe . All were served from the same host. We analyzed the three binaries: they are the same full-featured, off-the-shelf remote access trojan rebuilt with different names, mutexes, campaign tags, and obfuscation passes.

Shared across all three : family (LodaRAT lineage), C2 my[.]thispc[.]net:4000 (cleartext TCP), identical C2 command set, identical drop files, identical persistence and execution model, and the same 01.reg build artifact that disables Windows Defender via group policy.

Each build installs the same four persistence mechanisms, differing only in the per-build token:

Self-copy to %APPDATA%\Windata\ .exe

HKCU\...\Run key + Startup shortcut ( PEEEPM / JCHLLN / YWRRFR )

A scheduled task re-running every minute

VBS watchdog ( PEEEPM.vbs / JCHLLN.vbs / YWRRFR.vbs ) that WMI-polls and respawns the process if killed, dropped in the %TEMP% folder

All three the drop-in alternate names svwin1.exe / svwin2.exe .

A substantial theft suite, driven by embedded and C2-supplied libraries (identical in all builds):

Chromium browsers (Chrome/Edge/Opera/Brave): cookies parsed via an embedded SQLite DLL; saved passwords decrypted with DPAPI → AES-256-GCM

Firefox : raw exfiltration of logins.json , key4.db , cert9.db

FileZilla: recentservers.xml

Wi-Fi: keys via netsh wlan ... Key=Clear

Arbitrary DPAPI blobs supplied by the C2

A WebBrowserPassView -style drop-and-run ( Pl2.exe /stext )

Surveillance and remote control

Keylogger plus regex-triggered screen capture writing into hidden %APPDATA%\Windata\mon\

Screen/window capture (configurable JPEG quality), webcam via escapi , microphone via BASS → MP3

Interactive shell , keystroke/mouse injection, full file manager (execute, copy, zip, download-and-execute, print), clipboard, chat GUI

UAC elevation of attacker-supplied VBS code

RDP, tunnels, and lateral movement

RDP enable + ngrok tunnel : creates an admin account, turns on RDP, opens port 3389 through nx.exe

Reverse SOCKS proxy via dropped Proxy_Client.dll

LAN propagation over TCP 445 using a dropped Etx.exe payload tool

USB spreader : moves files into a hidden folder, drops self as sx.exe with an autorun shortcut

All three beacon over cleartext TCP to my[.]thispc[.]net:4000 , reconnecting every 9 seconds with a 600-second idle timeout.

Inbound packets carry a ZeXro0 framing token (stripped before dispatch); commands are matched by per-feature string markers.

The outbound beacon is a single, complete pipe-separated packet of 14 fields (identical in all builds):

Explanation of the various fields:

The campaign field is the per-build switch: “COURT-2026” in the SystemSettings build, “Court-ADR” / “COURT-ADR” in the two other builds. It becomes “Admin” whenever the process is running elevated. The rest of the command marker set is identical across all three builds , confirming one builder / toolchain.

Most dangerous commands (markers shown):

Anti-resubmission / Defender kill: exits if already running (unique mutex window title per build); if run from a non-legit name ( Settings.exe / Task Manager.exe / Microsoft Edge.exe or the shared svwin1.exe / svwin2.exe ), drops 01.reg with a random name, permanently disabling Windows Defender via group-policy keys ( DisableAntiSpyware , DisableBehaviorMonitoring , DisableOnAccessProtection ).

Self-copy to %APPDATA%\Windata\ .exe .

Fingerprint: AV product, UAC level, OS, arch, resolution, laptop/desktop, MAC.

Persistence: Startup shortcut, Run key, scheduled task, watchdog.

C2 loop: beacon, then a TCPRecv / dispatch loop handling commands; the monitor/keylogger runs continuously.

The three samples are squarely LodaRAT lineage : identical marker-driven cleartext C2 with a stripped ZeXro0 framing token, signature capability set: WebBrowserPassView password theft, ngrok / nx.exe RDP tunneling, SOCKS reverse proxy DLL, escapi webcam, BASS microphone, regex-driven monitor writing into Windata\mon , and VBS WMI watchdog. Finding the same command set and C2 across three differently disguised builds is the strongest evidence of a single operator / builder, with “COURT-ADR” / “COURT-2026” anchoring the current campaign.

The campaign anchors on a roughly 20-year-old domain, courtadr[.]com , whose current operator took over TLS management on March 3, 2026, and batch-provisioned supporting subdomains by late April.

The phishing page, florida[.]courtadr[.]com (CyberPanel-OLS/2.5.0 behind Cloudflare), is cloaked: only Edge user-agents get real content. An unprotected sibling subdomain, support[.]courtadr[.]com (CyberPanel-OLS/2.4.4), resolves directly to the true origin server 67[.]217[.]49[.]66 (InterServer), where it runs a white-labeled Acelle Mail bulk-email platform on EOL PHP 7.4.33. This is likely the sender of the phishing emails.

The LodaRAT payloads ( msedge.exe , SystemSettings.exe , and Taskmgr.exe ) come from the typosquat us[.]wind0ws[.]net (GoDaddy since Sept. 5, 2023, CyberPanel-OLS/2.5.0), which redirects casual visitors to the real windows.com . This host runs the same CyberPanel version as the phishing page and shares identical Cloudflare nameservers with the thispc[.]net C2 domain; a single operator is running the whole chain.

The RAT’s C2 is my[.]thispc[.]net:4000 over a raw TCP socket, resolving directly to 207[.]148[.]77[.]235 on Vultr (Singapore).

Infrastructure timeline

March 3, 2026: the current operator began actively managing TLS for the root domain courtadr[.]com . This is the first concrete, dateable evidence of the takeover/compromise.

April 26-27, 2026: support[.]courtadr[.]com (Acelle Mail) and other subdomains received their first certificates within approximately 24 hours of each other. This is consistent with batch provisioning of the campaign’s supporting infrastructure.

July 30, 2026: florida[.]courtadr[.]com , the actual phishing landing page, received its first certificate.

Aug. 1-2, 2026: the RAT payloads were compiled and the ISO disk image was built, completing the chain.

Given that courtadr[.]com is roughly 20 years old with clear signs of infrastructure changes over time, it is reasonable (although unproven) that this domain was a legitimate, older website whose server was compromised and is now being reused without its original owner’s knowledge.

How ThreatDown protects

ThreatDown Endpoint Protection blocks the RAT samples. Detections appear as Backdoor.LodaRAT and Trojan.Crypt.AutoIt :

Endpoint Protection also blocks network communications to the phishing page, the RAT distribution server, and the RAT C2 server:

This campaign is a textbook example of modern social engineering: a convincing court-themed lure, a phishing website that personalizes itself for every target, and a sophisticated multi-layered delivery chain designed to evade detection at each step. Behind the polished facade, however, is a familiar threat: LodaRAT, an off-the-shelf remote access trojan reused and re-skinned across all three disguises we uncovered.

For defenders, two truths stand out. First, threat actors are now investing heavily in the front end of attacks (compromised domains, credible branding, personalized targeting) precisely because the back end (commodity malware) remains so cheap and effective. Second, relying on users to spot cleverly disguised phishing simply isn’t a strategy. The chain only needs to be broken once, and the best place to break it is at the endpoint.

That’s where ThreatDown comes in. ThreatDown Endpoint Protection detects and blocks these LodaRAT samples out of the box, flagging them as Backdoor.LodaRAT and Trojan.Crypt.AutoIt, and blocks the campaign’s network communications to the phishing page, distribution server, and C2 infrastructure before any damage is done.

Indicators of compromise