An established remote access trojan is gaining fresh access to corporate computers through fake federal court proceedings.
ThreatDown researchers report that a phishing campaign using fabricated legal notices and a counterfeit court website targets more than 100,000 companies with LodaRAT. Their October 21 report describes the campaign’s potential reach, not a confirmed infection count. The lure impersonates the US District Court for the Southern District of Florida.
Once executed, LodaRAT can steal browser credentials and session cookies, record user activity, capture audio and video, and provide remote control over an infected Windows machine.
The campaign shows how attackers can keep compromising users with well-known malware by customizing the social engineering around it, rather than relying on a new exploit or previously unknown vulnerability.
One malware, many reasons to fall victim
The attackers paired an established malware family with a personalized legal lure designed to make malicious downloads appear legitimate.
According to ThreatDown, the attack, like several others, begins with a phishing email. This one impersonated the US District Court for the Southern District of Florida.
Sent from Resolution@courtadr[.]com with a subject line beginning “Court-Ordered ADR Notice” and including the target’s details and ADR ID, the message mimics official court correspondence, complete with a case reference formatted to resemble a civil case identifier. The notice names the recipient's company in connection with an alleged Alternative Dispute Resolution (ADR) proceeding and directs them to a website for further details.
Rather than relying on a generic greeting and a vague threat, the attackers give each target a fabricated case ID, using it in both the subject line and the message's links.
The personalization continues after the click. The website at florida[.]courtadr[.]com looks like an official court-related portal, displaying the company's details the same way they appeared in the phishing email.
They didn't stop there. The bogus site also offers several court-related pages and a search function that lets visitors look up fabricated cases by ADR ID.
These features give the victim more than a convincing email; they create an entire setting in which the alleged case appears to exist.
Then comes the download. Clicking “Download Your Case File” provides a password-protected ZIP archive named after the recipient’s ADR reference.
Inside is an ISO disk image labeled “Alternative Dispute Resolution A,” which opens to reveal three files: an .msc console file, a .bat batch script, and a .lnk Windows shortcut. Each is presented under a name associated with court proceedings, but each provides a different route to the same outcome.
Each file provides a different route to downloading and running LodaRAT through legitimate Windows components. The .msc route requires an additional click inside the console window.
Threat impact
The researchers say the campaign targeted more than 100,000 companies, though the figure represents targeted businesses, not confirmed payload infections.
The payload targets Windows. ThreatDown says the phishing website serves its intended content only to visitors whose browser identifies itself as Microsoft Edge; this filtering is separate from the malware’s capabilities.
Once installed, the remote access trojan can steal browser credentials and session cookies, log keystrokes, capture screenshots, record audio, access webcams, and execute commands remotely. It can also establish persistence, attempt to weaken Windows Defender, and create routes for further access to compromised systems.
What defenders and enterprises can do
The Southern District of Florida court is aware of the campaign and has warned the public through its official phishing and fraudulent court email advisory. Anyone receiving an unexpected notice, whether legal or not, should verify it using independently obtained contact details rather than links or phone numbers in the message.
For businesses, the practical concern is that a personalized legal notice can reach employees who are not equipped to assess the accompanying files. Organizations should establish a clear process for forwarding unexpected court correspondence to legal and security teams, with verification taking place through independently obtained court contact details. Employees should not need to download an alleged case file to determine whether a notice is genuine.
Security teams should also review how their email and endpoint controls handle password-protected archives, disk images, scripts, and shortcuts received from external sources. Where these file types serve a legitimate business purpose, teams should assess whether inspection and execution controls cover the full download chain. A familiar filename or a convincing website should not be treated as evidence that a file is safe.
The indicators in ThreatDown’s report provide a starting point for checking available email, DNS, proxy, and endpoint logs. Teams should investigate matches in context and review related process activity, rather than treating the absence of a known indicator as proof that a device is clean. Behavioral monitoring can help identify suspicious activity when attackers change domains or rename files.
If an employee has already opened a suspicious file, the response should extend beyond deleting the download. Security teams should assess the device for persistence and unauthorized access, investigate possible credential or session theft, and follow their incident response procedures for containment and recovery. Awareness training should reinforce prompt reporting so employees escalate a possible mistake while responders can still limit its impact.
Read more: Fake legal notices are one route to unauthorized access; learn how another phishing campaign uses business-themed documents to install remote-management tools and what defenders can monitor.