Phishing Campaign Targets 100,000+ Businesses with LodaRAT Malware

• •Over 100,000 businesses targeted by a phishing campaign impersonating a U.S. court.
• •LodaRAT malware is delivered via a fraudulent court portal and disguised executables.
• •The U.S. District Court has issued an alert about the ongoing phishing attacks.

A phishing campaign impersonating the U.S. District Court for the Southern District of Florida has targeted over 100,000 businesses, delivering LodaRAT malware. The attackers send emails with unique Alternative Dispute Resolution (ADR) IDs, directing recipients to a fraudulent court portal. This portal prompts users to download a password-protected ZIP file containing an ISO file with three disguised executables: SystemSettings.exe, Taskmgr.exe, and msedge.exe. All three files ultimately install the same LodaRAT payload, which allows remote access and control of infected systems. The malware can capture keystrokes, steal credentials, and record audio and video. The U.S. District Court has issued a public alert regarding these fraudulent communications. The campaign's infrastructure has been traced to a domain that has undergone recent changes, although it is unclear if it was compromised. ThreatDown has confirmed that their Endpoint Protection blocks the RAT samples and associated network communications.