Fake Court ADR Phishing Campaign Targets Over 100,000 Companies With LodaRAT - Cybersecurity Insiders
A phishing campaign impersonating the United States District Court for the Southern District of Florida has targeted over 100,000 companies with fraudulent Alternative Dispute Resolution notices distributing LodaRAT malware.
According to research from ThreatDown, attackers are sending personalized emails containing unique ADR case identifiers that direct recipients to florida[.]courtadr[.]com, a fraudulent court portal. The website displays company-specific information and encourages visitors to download supposed legal documents through a password-protected ZIP archive.
Malware Distribution
The archive contains an ISO disk image with three malicious files: Court_Order_for_ADR.msc, Original_Complaint.bat, and Supporting-lawsuit-documents.lnk. Each uses different execution methods to download and launch LodaRAT variants disguised as legitimate Windows executables.
The malware provides extensive capabilities, including credential theft from major web browsers, keylogging, screen capture, webcam and microphone access, and remote system control.
Attack Infrastructure
Researchers identified multiple persistence mechanisms, including Windows Registry Run keys, Startup shortcuts, scheduled tasks, and watchdog scripts. All three malware variants communicate with the same command-and-control server at my[.]thispc[.]net:4000.
The campaign uses coordinated phishing, malware distribution, and C2 infrastructure, with activity associated with its preparation dating back to March 2026. ThreatDown reported that its Endpoint Protection product detects the malicious samples as Backdoor.LodaRAT and Trojan.Crypt.AutoIt.
Related
