A phishing campaign posing as official notices from US federal courts is targeting more than 100,000 businesses, with the aim of installing the LodaRAT remote access trojan on their computers. The messages exploit the authority of the judicial system to push recipients into opening an attachment or clicking a link, opening the way to remote control of the machine.
The mechanism is the classic phishing playbook, with a particularly convincing disguise. The emails imitate the form of a legal notice: a proceeding involving the recipient, a deadline, a request to review a document. Anyone receiving the message, especially those who handle legal matters, accounts or dealings with creditors, has a concrete reason not to ignore it. The operators of the campaign rely precisely on that urgency.
The scale is the figure that stands out most: the businesses reached number in the hundreds of thousands of potential targets. The available sources do not clarify how many recipients opened the attachment or were actually compromised, which is an important limit when assessing the real impact. What emerges clearly is the intent to hit a wide range of US companies indiscriminately.
To understand why this type of scam works, it helps to recall the recent context. For about a week US federal bankruptcy courts have struggled to send official communications, after a cyberattack against BAE Systems blocked the Bankruptcy Noticing Center, the centre that produces and sends notices in bankruptcy cases. When official notices struggle to arrive, a fake message posing as a court communication finds fertile ground: those waiting for news from a court are more inclined to trust an apparently legitimate email.
US judicial authorities have already issued warnings about the phenomenon. The federal courts' website notes that malicious calls and emails aimed at those who interact with the courts can lead to money or personal information being stolen, and urges recipients not to act on unverified requests.
The campaign fits into a broader trend. Back in June, Google Cloud had documented a targeted campaign against US law firms, based on vishing and social engineering to gain remote access to corporate environments. On the malware front too, the US Justice Department seized five domains used to run the LummaC2 information-stealing malware service in May 2025, showing how widespread and organised these tools already are.
For businesses the practical advice is simple but decisive: always verify the sender and any presumed legal communication by contacting the court directly through its official channels, never the details given in the message. Do not open unexpected attachments or links, and promptly report any suspicious communication to your security team, because the speed at which this kind of campaign spreads demands a rapid response.
No comments yet. Be the first!