Overlord RAT uses forged Brazilian notary emails to deliver malware

WatchGuard’s Red Cell team uncovered a new Overlord RAT campaign that relies on fake Brazilian protest notary notices. The emails, sent from eight domains such as 1protestorecife.com and cartorioquintela.com, include valid CNPJ numbers to make the notices appear legitimate. Clicking a link downloads an obfuscated VBScript that pulls additional files from Dropbox or Google Cloud Storage.

The VBScript chain uses PowerShell and curl to fetch payloads, then modifies Microsoft Defender exclusions to lower the chance of detection. The malware also abuses legitimate Windows tools, loading malicious DLLs through Microsoft’s .NET Framework executable ngentask.exe and the VLC media player. A variant creates scheduled tasks named "Windows Error Reporting" to maintain persistence.

A Go-based executable downloads an encrypted file called werdata.db. The file is decrypted with the Chaskey cipher in counter mode, revealing Donut x64 shellcode. The RAT then contacts command-and-control servers at 191.96.225.125 and 45.158.8.213 on port 5173. The code references Brazilian financial institutions such as C6Bank, PicPay, Banco Inter and Caixa Econômica Federal.

Lampion banking trojan spreads through ZIP attachments

A separate campaign delivers the Lampion banking trojan via phishing emails that contain ZIP attachments with HTML files. The HTML files pull scripts from AWS S3 or Google Drive. The VBScript stages are heavily obfuscated, with junk code that complicates analysis. The command-and-control infrastructure includes Russian-based IP addresses.

Portuguese ISO dropper adds another vector

A third campaign uses a Portuguese-language website titled "Download Seguro – Factura" and a fake CAPTCHA to distribute an ISO file. Inside the ISO is a VBScript, VMware’s legitimate vnetlib.exe, and a malicious newdev.dll. When vnetlib.exe loads the DLL, the code decrypts a 64-bit Pascal DLL that can execute commands, transfer files, control the mouse and keyboard, and stream the victim’s screen. It also writes a registry entry to survive reboots.

Practical risks for users

The Overlord RAT campaign demonstrates a blend of social engineering and technical stealth. Users who receive emails purporting to be from Brazilian notary offices should verify the sender’s domain and CNPJ number against official registries. The use of legitimate Windows tools and cloud storage services makes the malware harder to flag by traditional antivirus solutions.

The Lampion trojan and ISO dropper expand the threat surface to banking credentials and remote control capabilities. Organizations should monitor for unusual outbound connections to the IP ranges identified by WatchGuard and inspect scheduled tasks named after legitimate Windows services.

What to watch next

WatchGuard’s findings suggest attackers are refining their delivery methods to blend in with legitimate software and cloud services. Future campaigns may target other legal or financial institutions in different jurisdictions. Security teams should keep their endpoint detection and response solutions updated and maintain strict whitelisting of trusted executables.

The Overlord RAT’s reliance on fake legal notices highlights the need for user education on email authenticity, especially when documents claim to be from government or legal bodies. Keeping an eye on domain registrations that mimic official notary offices can provide early warning of similar phishing attempts.

Explore more on this topic