Back Gbhackers

Judicial Targets Hit by COVERT RAT via Court Docs and GitHub Payloads

Gbhackers •Mayura Kathir • March 18, 2026

Attackers are abusing fake court documents and GitHub‑hosted payloads in a focused spear‑phishing campaign that deploys a stealthy Rust‑based COVERT RAT against Argentina’s judicial sector. This operation chains Windows LNK shortcuts, BAT loaders, and PowerShell to quietly fetch and execute a masqueraded payload, msedge_proxy.exe, from GitHub infrastructure. The operation, tracked as “Operation Covert Access,” uses […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Targeted COVERT RAT Attacks on Argentina's Judicial Sector Using Court Docs and GitHub Payloads A spear-phishing campaign dubbed Operation Covert Access is targeting Argentina's judicial sector with a Rust-based Remote Access Trojan (RAT) known as COVERT RAT. Attackers are leveraging fake court documents to deceive legal professionals into executing malicious payloads. The attack method involves chaining Windows LNK shortcuts, BAT loaders, and PowerShell scripts to download and execute the RAT from GitHub. The stealthy nature of the malware allows it to operate undetected, posing significant risks to sensitive judicial data. This targeted operation highlights vulnerabilities within the judicial system's cybersecurity defenses. The campaign is ongoing, and affected systems include various components of the judicial infrastructure. Specific numbers and CVEs were not disclosed in the articles, but the threat level is considered high due to the targeted nature of the attacks. Legal professionals are advised to exercise caution when handling unexpected court communications. 2 sources 64

Extracted Entities

Judicial Targets Hit by COVERT RAT via Court Docs and GitHub Payloads

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (2)

Tools (1)