LodaRAT phishing: Fake US Court Notices Target 100,000+ Businesses
On 28 October 2026, ThreatDown researchers exposed a large-scale phishing operation that masquerades as the United States District Court for the Southern District of Florida. The campaign has already reached more than 100,000 firms, luring recipients into downloading a password-protected ZIP that contains an ISO image. Inside the ISO, three files—an MSC, a batch file, and a Windows shortcut—each trigger a different execution path, but all deliver the same payload: LodaRAT, a remote access trojan that captures keystrokes, steals browser credentials, records audio and video, and can enable Remote Desktop Protocol (RDP) connections.
How the front end convinces victims
The phishing emails include a unique civil case identifier and a link to a counterfeit court portal. The portal displays the target company’s name and contact details, creating a personalized illusion of legitimacy. To evade spam filters, the site serves content only to users who access it with Microsoft Edge; other browsers receive a blank page. The domain used for the portal is a typosquatted us.wind0ws.net, and the filenames of the delivered files mimic legitimate Windows components such as Taskmgr.exe, SystemSettings.exe, and msedge.exe.
The United States District Court for the Southern District of Florida has issued an official alert warning the public about these fraudulent communications. The alert advises recipients to verify any notice by visiting the court’s official website or calling the court’s public information office.
Persistence and lateral movement
Once LodaRAT is installed, it establishes persistence through several mechanisms: registry Run keys, startup shortcuts, scheduled tasks, and a VBScript watchdog that restarts the malware if it is stopped. The script also scans the local network for other Windows machines and can spread via RDP or shared folders, turning a single compromised host into a foothold for further lateral movement.
Infrastructure and domain history
ThreatDown traced the campaign’s infrastructure to courtadr.com, a domain that has existed for roughly 20 years. The domain’s certificate management changed in March 2026, and new subdomains appeared thereafter. The evidence does not confirm whether the original domain was compromised or whether the attackers registered it anew.
Why the attack matters
The operation demonstrates that attackers are investing heavily in the front end—personalized legal-themed emails, credible branding, and domain spoofing—while still relying on commodity malware that is cheap and effective. The combination lowers detection risk and increases the likelihood that recipients will click the link and download the malicious payload.
Practical steps for affected businesses
- Verify any court notice by checking the official court website or contacting the court directly. Do not download attachments from unsolicited emails.
- Block the typosquatted domain us.wind0ws.net and any subdomains of courtadr.com in your DNS or firewall.
- Scan for LodaRAT on all Windows machines. Look for registry Run keys, startup shortcuts, scheduled tasks, and the VBScript watchdog.
- Update endpoint protection to detect and block RAT activity, including keystroke logging and RDP exploitation.
- Educate employees about the specific phishing vector: a court-themed email that appears to require a password-protected ZIP.
What to watch next
The attackers’ use of a court front end suggests they may expand to other jurisdictions or legal themes. Monitoring for similar phishing campaigns that target other court systems or regulatory bodies will be essential. Additionally, the persistence mechanisms employed by LodaRAT indicate that a single infection can seed a broader network compromise, so network segmentation and strict RDP controls remain critical.
Related coverage
For a deeper dive into how legal-themed phishing attacks spread, see the post on Overlord RAT’s use of fake Brazilian legal notices.