Press play to start listening
Fake US court notices target over 100,000 businesses, luring recipients to download LodaRAT malware that steals passwords, records activity and controls PCs.
Cybersecurity researchers at ThreatDown have uncovered a large-scale phishing campaign impersonating the United States District Court for the Southern District of Florida. The operation has so far targeted more than 100,000 businesses using fake notices regarding Alternative Dispute Resolution (ADR) cases to trick recipients into downloading malware.
The emails contain unique civil case identifiers and links to a fraudulent court portal that displays each target company’s name and contact details. To evade security filters, the site restricts access based on the visitor’s browser software, displaying content only to users who visit using Microsoft Edge.
The US District Court for the Southern District of Florida has issued an official alert to warn the public about these fraudulent communications.
Three Routes Deliver the Same Malware
Once on the site, targets are urged to download a password-protected compressed file to view their case documentation. The file contains a single optical disk image (ISO) containing three different file types: an MSC file, a batch file and a Windows shortcut. Opening any of the files triggers a distinct execution path, though all three routes ultimately download the same malware.
The payloads come from a typosquatted domain, us.wind0ws.net, and use filenames associated with legitimate Windows components: Taskmgr.exe, SystemSettings.exe and msedge.exe.
ThreatDown identified the malware as LodaRAT, a remote access trojan (RAT) that allows attackers to remotely control infected systems. Hackread.com previously reported on LodaRAT in 2021, when researchers documented a version capable of targeting Android devices.
ThreatDown found that LodaRAT contains extensive surveillance mechanisms. It can capture keystrokes, steals saved login credentials from major web browsers, records audio and video, and extracts Wi-Fi passwords. It can also enable Remote Desktop Protocol (RDP) connections and spread across local networks.
How LodaRAT Maintains Access
LodaRAT sets up registry Run keys, startup shortcuts and scheduled tasks to launch again after a reboot, and drops a VBScript watchdog that checks whether the malware is running. It starts it again if the process is stopped.
Researchers traced the campaign’s infrastructure to courtadr.com, a roughly 20-year-old domain. They observed changes to its certificate management beginning in March 2026, followed by the creation of supporting subdomains. However, the available evidence does not establish whether the original domain was compromised.
“Threat actors are now investing heavily in the front end of attacks (compromised domains, credible branding, personalized targeting) precisely because the back end (commodity malware) remains so cheap and effective,” the researchers explained in the blog post shared with Hackread.com.
The findings highlight how personalized legal-themed emails can be used to deliver malware while making fraudulent requests appear credible.
