A phishing campaign impersonating the United States District Court for the Southern District of Florida is targeting more than 100,000 companies with fraudulent Alternative Dispute Resolution (ADR) notices designed to distribute LodaRAT, a remote access trojan (RAT).
According to research from ThreatDown, attackers are sending personalized emails containing unique ADR case identifiers that direct recipients to florida[.]courtadr[.]com, a fraudulent court portal. The website displays company-specific information and encourages visitors to download supposed legal documents through a password-protected ZIP archive.
The archive contains an ISO disk image with three malicious files: Court_Order_for_ADR.msc, Original_Complaint.bat, and Supporting-lawsuit-documents.lnk. Each uses a different execution method to download and launch LodaRAT variants disguised as legitimate Windows executables, including SystemSettings.exe, Taskmgr.exe, and msedge.exe.
The malware provides extensive capabilities, including credential theft from major web browsers, keylogging, screen capture, webcam and microphone access, and remote system control. It also supports RDP tunneling, reverse SOCKS proxy connections, and lateral movement across compromised networks.
Researchers identified multiple persistence mechanisms, including Windows Registry Run keys, Startup shortcuts, scheduled tasks, and watchdog scripts. All three malware variants communicate with the same command-and-control (C2) server at my[.]thispc[.]net:4000.
The campaign uses coordinated phishing, malware distribution, and C2 infrastructure, with researchers identifying activity associated with its preparation dating back to March 2026.
ThreatDown reported that its Endpoint Protection product detects the malicious samples as Backdoor.LodaRAT and Trojan.Crypt.AutoIt and blocks communications with the campaign’s malicious infrastructure.
The findings highlight how attackers continue to combine convincing social engineering with established malware families to compromise organizations, steal sensitive information, and maintain unauthorized access.
For a detailed technical analysis, including malware execution methods, infrastructure findings, and indicators of compromise (IOCs), read the full ThreatDown research report.
Join our LinkedIn group Information Security Community!
