LodaRAT Phishing Campaign Targets 100,000+ Businesses With Fake Court Notices

Key points

• Attackers use counterfeit court summonses to push LodaRAT downloads.
• The campaign is reported to reach over 100,000 businesses.
• The payload steals passwords and login data and can record activity.
• No CVE is involved, so detection must focus on phishing and endpoint behavior.

Unidentified threat actors are using counterfeit legal paperwork as a lure to spread LodaRAT malware. The messages purport to be court-related notices and prompt recipients to open links or attachments, which then deliver the malicious payload. No software vulnerability is associated with this activity; the entry point is user interaction with the fraudulent notice.

The reported reach is substantial: more than one hundred thousand businesses are said to be in the campaign's target set. For K-12 and government entities, the risk is not only direct compromise but also downstream credential reuse. LodaRAT is described as capable of harvesting passwords and other login data, and it can record activity on infected systems.

Because the payload can capture credentials and observe user actions, an infection could expose email, finance, student information, and administrative systems. The absence of a CVE means patching alone will not stop it; controls must address phishing resilience, attachment and link handling, and endpoint detection.

Watch for reports of court-themed messages, unexpected LodaRAT alerts, and authentication anomalies. Organizations should verify legal notices through independent channels, restrict macro and attachment execution, and monitor for remote-access tool behavior. Incident responders should isolate suspected hosts and reset exposed credentials.

What to do now

1. Block and quarantine court-themed lures: add email rules for legal-notice subject lines and attachments, and tell staff to verify notices through official court channels.
2. Harden email handling: enforce DMARC, disable auto-forwarding, detach and scan links, and block executable attachments.
3. Deploy endpoint detection for LodaRAT behaviors, including remote access, recording features, credential dumping, and unusual child processes.
4. Enforce phishing-resistant MFA and reset credentials for any suspected exposure; review privileged and service accounts.
5. Restrict execution with application allowlisting, disabled macros, and limited PowerShell and script-host use.
6. Run targeted awareness training so staff report unexpected legal documents instead of opening them.
7. Prepare incident response: isolate hosts, collect forensic images, block command-and-control traffic, and notify authorities per policy.

Original source

Hackread