Judicial Targets Hit by COVERT RAT via Court Docs and GitHub Payloads

Attackers conducted a focused spear‑phishing campaign (“Operation Covert Access”) targeting Argentina’s judicial sector using realistic court‑themed PDFs and a ZIP containing a disguised LNK, a BAT loader, and a PDF decoy; the LNK launches PowerShell to download a GitHub‑hosted Rust-based RAT (msedge_proxy.exe) placed in an Edge profile path. The RAT includes extensive anti‑analysis checks, modular capabilities for persistence, data harvesting, file upload/download, encryption and credential theft, and the report provides SHA256 IOCs and mitigation recommendations for legal and government defenders.