Judicial Targets Hit by COVERT RAT via Court Docs and GitHub Payloads

Attackers are abusing fake court documents and GitHub‑hosted payloads in a focused spear‑phishing campaign that deploys a stealthy Rust‑based COVERT RAT against Argentina’s judicial sector.

This operation chains Windows LNK shortcuts, BAT loaders, and PowerShell to quietly fetch and execute a masqueraded payload, msedge_proxy.exe, from GitHub infrastructure.

The operation, tracked as “Operation Covert Access,” uses authentic‑looking Argentine federal court rulings about preventive detention reviews as lures to compromise victims.

Targets include federal courts, legal practitioners, justice‑related government bodies, academic institutions, and legal advocacy groups across Argentina’s wider judicial ecosystem.

By weaponizing highly realistic judicial PDFs, the attackers exploit trust in official communications to gain initial access and establish long‑term footholds in high‑value legal environments.

Analysis builds upon research published by Seqrite on covert RAT phishing campaigns extend their work with in-depth insights into the PowerShell execution flow of .bat files.

Available evidence and the nature of the targets suggest an espionage‑driven objective, with operators seeking persistent access to sensitive legal and institutional data rather than one‑off financial gain.

Spear‑phishing, LNK, and BAT chain

The intrusion starts with spear‑phishing emails delivering a ZIP archive that contains three files: a weaponized LNK shortcut, a BAT‑based loader script, and a court‑themed PDF decoy.

When the victim opens the LNK (disguised with a PDF icon and legal filename), it launches PowerShell directly from the system directory, bypassing execution policy and running in hidden mode while simultaneously opening the benign‑looking PDF front‑end.

This dual‑action approach lets the attacker execute code silently in the background while the user focuses on the court ruling, minimizing suspicion and user friction.

The BAT file (info/health-check.bat) then takes over as a loader, using PowerShell to instantiate a WebClient object with a browser‑like User‑Agent string and connect to a GitHub‑hosted URL.

It retrieves a file named health-check.exe and saves it as msedge_proxy.exe under the Microsoft Edge user data directory, adopting both a trusted filename and a plausible location inside the browser profile tree.

Finally, the script invokes Start‑Process on msedge_proxy.exe, transitioning from staged loader activity into full RAT execution under the guise of legitimate browser‑related behavior.

COVERT RAT behavior and evasion

Once launched, msedge_proxy.exe performs extensive anti‑virtualization, anti‑sandbox, and anti‑debugging checks, terminating immediately if it detects analysis artifacts.

It queries the system manufacturer via WMIC, scans registry keys and filesystem paths associated with VMware, VirtualBox, Hyper‑V, and common analysis setups, and inspects running processes for tools such as Wireshark, Procmon, and debuggers.

Additional checks leverage Windows internals such as PEB debugger flags, timing tests around sleep calls, and performance counter behavior to spot emulators or instrumented environments.

If the host passes these checks, the malware enumerates hostname, username, OS version, architecture, and privilege level, then establishes a resilient command‑and‑control channel with IPv4/IPv6 parsing and a hard‑coded fallback C2 string.

The implant exposes a modular command set PERSIST, DOWNLOAD, UPLOAD, HARVEST, ENCRYPT, DECRYPT, and ELEVATE allowing operators to manage persistence, move files in both directions, harvest data, and trigger encryption or privilege‑escalation routines.

Instructions are Base64‑encoded before transit and decoded on the endpoint, enabling the dynamic loading of DLL‑based ransomware and credential‑stealing modules such as ransomware.enc/stealer.enc with corresponding keys.

A dedicated PERSIST_REMOVE command supports full cleanup of Registry Run keys, Scheduled Tasks, and other autostart entries, giving attackers both long‑term persistence and a controlled exit strategy when needed.

This campaign shows how trusted content and infrastructure court documents and GitHub are combined with shortcut‑based execution to bypass user suspicion and many legacy controls.

Defenders in legal and government environments should tighten controls around LNK execution, restrict scriptable access to external repos, and monitor for anomalous PowerShell usage that spawns from shortcuts and writes browser‑named binaries into Edge profile paths.

IOCs

SHA256	Name
13adde53bd767d17108786bcc1bc0707c2411a40f11d67dfa9ba1a2c62cc5cf3	Zip File
10bbc5e192c3d01100031634d4e93f0be4becbe0a63f3318dd353e0f318e43de	juicio-grunt-posting.pdf
6ae4222728240a566a1ca8c8873eab3b0659a28437877e4450808264848ab01e	health-check.bat
4612c90cdfb7e43b4e9afe2a37a82d8b925bab3fd3838b24ec73b0e775afdb75	msedge_proxy.exe
37e6da4c813557f09fa2336b43c9fbb4633e562952f5113f6a6a8f3c226854eb	notas.pdf

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.