A highly sophisticated phishing campaign, dubbed Operation Covert Access, is actively targeting Argentina’s judicial sector to deploy a covert Rust-based Remote Access Trojan (RAT).
By using authentic-looking federal court rulings regarding preventive detention as lures, the attackers trick legal practitioners and government agencies into initiating a multi-stage infection chain.
This operation relies on trusted delivery channels and advanced evasion techniques to establish persistent, stealthy access within sensitive institutional networks.
Attack Chain and Execution Flow
The intrusion begins with a spear-phishing email containing a compressed ZIP archive. When extracted, the victim is presented with three files: a judicial-themed PDF decoy, a weaponized LNK shortcut, and a BAT loader script.
Interacting with the LNK file seamlessly opens the legitimate-looking PDF in the foreground to avoid suspicion, while silently triggering the malicious loader in the background.
Evasion Tactics and Payload Capabilities
The dropped payload demonstrates extensive anti-analysis and evasion behavior to ensure it only executes on genuine host machines.
It immediately checks the system manufacturer details and queries registry paths for common virtualization indicators like VMware, VirtualBox, and Hyper-V. Furthermore, it scans active processes for debugging tools such as Wireshark or Procmon.
It performs timing checks on the Process Environment Block (PEB). If any analysis environment is detected, the malware terminates instantly.
Once the environment is validated, the RAT gathers comprehensive host system information, including hostname, operating system, and privilege levels.
It establishes a resilient command-and-control (C2) connection, supporting IPv4 and IPv6 parsing, and uses a hardcoded fallback address to ensure uninterrupted communication.
The C2 server transmits Base64-encoded commands that allow the attacker to control the compromised machine fully.
According to Point Wild research, the malware features a highly modular architecture. Commands such as HARVEST trigger a credential-stealing module that relies on dynamically decrypted DLLs.
The ENCRYPT and DECRYPT commands activate a ransomware engine that can lock system files.
In contrast, the ELEVATE command uses PowerShell to request administrative rights through User Account Control bypasses.
The malware also includes extensive file transfer capabilities and a PERSIST_REMOVE command that allows attackers to cleanly wipe their registry keys and scheduled tasks, effectively removing traces of the infection once their objectives are complete.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
