A phishing email pretending to come from the United States District Court for the Southern District of Florida targets more than 100,000 companies, according to ThreatDown research published on 27 October 2026. Each message carries the target company’s name and a unique ADR ID, and links to a fake court portal delivering LodaRAT, a remote access trojan.
One number needs care before anything else. The 100,000+ figure is ThreatDown’s estimate of how many companies are targeted, based on the personalised pages it found. None of the sources cited here reports a confirmed number of infected companies, and no victim company has been named. The headline figure is an estimate of targets. It does not measure how many victims were infected.
What the fake notice looks like
The message is sent from Resolution@courtadr[.]com with a subject line in the form “Court-Ordered ADR Notice for [company] – ADR ID: [ID]”, mimicking a document from the United States District Court for the Southern District of Florida. Its link redirects to florida[.]courtadr[.]com/search[.]php?ADR_ID=<ADR_ID>.
The fake portal filters by browser: only Microsoft Edge user-agents get real content. HackRead’s 28 October 2026 coverage corroborates this.
The portal invites the target to click “Download Your Case File”, delivering a password-protected ZIP archive named after the ADR ID, for example 7_26-cv-04501-ADR.zip, whose password is the ADR ID itself. Inside is a single ISO disk image named Court_Order_for_ADR.iso.
The ISO contains three files: Court_Order_for_ADR.msc, Original_Complaint.bat, and Supporting-lawsuit-documents.lnk. The .bat and .lnk files run their paths on double-click, while the .msc file opens an administrative snap-in where the user must then click “Click Here to View Your ADR” for the malicious command to run. All three routes lead to a LodaRAT variant, rebuilt under three names (SystemSettings.exe, Taskmgr.exe, msedge.exe), served from us[.]wind0ws[.]net and beaconing to my[.]thispc[.]net:4000. Three files, three variants of the same RAT: recognising one file type is not enough. The tell is the download itself, a “case file” that turns out to be a ZIP containing an ISO, not which file inside it is opened.
What LodaRAT does once it runs
ThreatDown’s analysis lists: a keylogger plus regex-triggered screen capture; saved-password and cookie theft from Chromium browsers and Firefox credential files; Wi-Fi password extraction; webcam and microphone capture; an interactive shell; RDP enablement plus an ngrok tunnel with a created admin account; a reverse SOCKS proxy; LAN propagation over TCP 445; and a USB spreader.
The malware copies itself to %APPDATA%\Windata\, sets an HKCU Run key plus a Startup shortcut, creates a scheduled task re-running every minute, and runs a VBS watchdog that respawns the process if killed. It also drops a .reg file disabling Windows Defender via group-policy keys.
ThreatDown says its Endpoint Protection blocks the RAT samples (Backdoor.LodaRAT and Trojan.Crypt.AutoIt) and network communications to the phishing page, distribution server, and command-and-control server.
What the real court says
The Southern District of Florida court is aware of the campaign and is alerting citizens through an advisory, per ThreatDown. The court’s advisory states that it has received several reports of citizens receiving fraudulent emails purportedly sent from the Court, and that recent samples reference a court-appointed mediator and an ADR matter, with an example ADR Conference ID No. 6:26-cv-12667-ADR. The advisory page itself carries no publication date, so the date meant by its word “today” cannot be established from the page.
The advisory states: “these case numbers do not exist in our system, and these emails do not originate from this Court”. Its instructions to recipients are to not click links or open attachments in such messages, to disregard them immediately, and, if they are unsure whether a court-related email is legitimate, to contact the court directly via its official phone number or website to verify before taking action.
What to do if you get one
- Do not click the link in the message or open any attachment it carries.
- Disregard the message immediately, and delete it from the inbox.
- Verify any real court matter only through the court directly, using its official phone number or website.
- Warn colleagues who handle mail or payments.
- If the file was already opened, treat that machine as compromised, disconnect it, and involve IT or security help promptly.
Our analysis: the numbers, kept straight
The following table and timeline are our own analysis. No source states them in this form.
| Measure | Figure | Source basis |
|---|---|---|
| Companies targeted | 100,000+ | ThreatDown estimate from personalised ADR IDs and pages |
| Companies confirmed infected | None disclosed | No confirmed infection total disclosed in the cited sources |
| Citizen reports to the court | “Several” | The court’s own wording |
| Named victim companies | None | No source names one |
The timeline, reconstructed from ThreatDown’s report dates, shows the trap was built months before the warning. The current operator began managing TLS for courtadr[.]com on 3 March 2026. Support subdomains were batch-provisioned on 26-27 April 2026. The florida[.]courtadr[.]com phishing page received its first certificate on 30 July 2026. RAT payloads were compiled and the ISO built on 1-2 August 2026. ThreatDown published its research on 27 October 2026, and HackRead and Cybernoz coverage followed on 28 October 2026. The court’s advisory is undated on its page, so its publication cannot independently be placed on that date. The takeaway: the domain and page predate the public report by about three months.
Two items stay unverified and are labelled as such. ThreatDown assesses that the courtadr[.]com domain was “a legitimate, older website whose server was compromised and is now being reused without its original owner’s knowledge”, but ThreatDown calls this “reasonable (although unproven)”. The operator is also unnamed: ThreatDown attributes the chain to a single operator or builder based on shared infrastructure and identical command sets, but names no group or individual. The campaign start date for victim targeting is unstated.
Sources
- ThreatDown, “Fake court ADR phishing campaign distributes LodaRAT”, 27 October 2026: https://www.threatdown.com/blog/fake-court-adr-phishing-lodarat/
- United States District Court, Southern District of Florida, “Advisory: Phishing / Fraudulent Court Email Alert”, read 28 October 2026 (no publication date printed on the page): https://www.flsd.uscourts.gov/advisory-phishing-fraudulent-court-email-alert
- HackRead, “Fake US Court Notices Target 100,000+ Businesses With LodaRAT”, 28 October 2026: https://hackread.com/fake-us-court-notices-target-businesses-lodarat/
- Cybernoz (republishing HackRead), “Fake US Court Notices Target 100000 Businesses With LodaRAT”, 28 October 2026: https://cybernoz.com/fake-us-court-notices-target-100000-businesses-with-lodarat/
