Colombia's national cyber emergency team is warning that a live malware campaign is arriving disguised as court paperwork. colCERT published alert AL-20260818-112 on 18 August describing an active AsyncRAT distribution campaign against Colombian organisations, and names government, financial, corporate services and retail as the sectors in scope. It rates the campaign high severity.
The lure is bureaucratic rather than technical. The messages impersonate judicial or official electronic notifications and appear to carry documents scanned with CamScanner, the phone scanning app plenty of Colombian offices use every day. The attachment is not a PDF. It is a .vbs file, a Visual Basic script, dressed to look like one.
Living off the machine's own tools
Once the script runs, the chain leans entirely on software Windows already ships. colCERT names wscript.exe, cscript.exe, PowerShell.exe and MSBuild.exe as the binaries the campaign abuses, a technique defenders call living off the land: nothing unfamiliar is installed, so perimeter and endpoint controls watch trusted Microsoft executables do the work. Deliberate file naming sits on top of that as camouflage.
The payload is not hosted on a throwaway domain either. It is pulled from Google Firebase Storage, a legitimate cloud service, which colCERT points out blunts any defence that works by scoring domain reputation. Command and control follows the same logic: the traffic is AES encrypted and goes to a subdomain of DuckDNS, a free dynamic DNS provider, so the address can move without the operators buying anything.
It goes straight for stored passwords
AsyncRAT is an open source remote access trojan that criminals have been recycling for years, and this deployment uses it for credential theft. colCERT observed attempts to inject into lsass.exe, the Windows process that holds authentication material in memory, in order to steal local and domain credentials and escalate from there. That is what turns one opened attachment into a network problem: the same credentials open file shares, mail and management consoles, and give an intruder the choice of moving laterally or selling the access on for a second stage.
The same team reported in early August on a crew that mined cryptocurrency inside Colombian networks before deploying ransomware, which is the shape this kind of access tends to take next. AsyncRAT itself keeps resurfacing in unrelated campaigns elsewhere, including one that hid it behind fake software installer sites in July.
Take the indicators, then hunt the script chain
colCERT publishes 32 SHA-256 sample hashes in the alert, along with the DuckDNS command and control domain, the Firebase Storage URL serving the payload, and nine IP addresses tied to the attacker's infrastructure. Defenders in Colombia should pull those from the alert itself, which is published TLP:CLEAR, rather than from any secondhand copy.
Beyond the indicator list, the useful controls are blunt ones. Block or quarantine .vbs, .js and similar script attachments at the mail gateway, because almost no legitimate correspondence needs them. Change the default handler so that double clicking a .vbs file opens Notepad instead of running it. Alert on wscript.exe or cscript.exe spawning PowerShell or MSBuild, and on anything reaching into lsass.exe.
The technical half of this campaign is ordinary. The social half is what makes it work, and it is worth naming plainly to staff: a court notice is exactly the message nobody feels safe ignoring, which is why it keeps getting opened.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.