Loading threat actor…
Blind Eagle, also known as APT-C-36, is a Spanish-speaking, likely Colombia-based cybercriminal threat actor active since at least 2018–2019. It primarily targets organizations in Colombia and other South American countries, using sustained Spanish-language spam and spearphishing campaigns against government, financial, health care, telecommunications, and energy organizations. Other reported aliases include APT-Q-98 and TAG-144. Blind Eagle commonly uses impersonation lures themed around Colombian government, judicial, tax, traffic-enforcement, banking, and personal matters. Its delivery chains have included password-protected archives, malicious documents containing embedded scripts or macros, and location-filtered shortened links that redirect selected victims to malware downloads while presenting benign content to others. The group has repeatedly rotated delivery infrastructure, URL-shortening services, and payload families to hinder detection. The actor has deployed commodity and open-source remote-access tooling including AsyncRAT, BitRAT, LimeRAT, njRAT, Remcos, DcRat, Quasar RAT, and related loaders and crypters. Observed tradecraft includes scheduled-task persistence disguised as legitimate software activity, hidden PowerShell execution, VBScript-based document execution, process hollowing, and DLL side-loading. Blind Eagle has also used commercial or publicly available packers, crypters, and remote-access tools, including HeartCrypt, PureCrypter, and HijackLoader. Its campaigns are assessed as primarily financially motivated rather than espionage-oriented.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
55 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
22 malware families attributed to this actor across reporting.
17 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
"...Colombian organizations were reported by Darktrace to have been targeted by Blind Eagle in an attack campaign involving the abuse of the Windows vulnerability, tracked as CVE-2024-43451, that has been ongoing since November."
A recently patched security flaw affecting Windows NTLM has been exploited by malicious actors to leak NTLM hashes or user passwords and infiltrate systems since March 19, 2025. The flaw, CVE-2025-24054 (CVSS score: 6.5), is a hash disclosure spoofing bug that was fixed by Microsoft last month as part of its Patch Tuesday updates. The security flaw is assessed to be a variant of CVE-2024-43451 (CVSS score: 6.5), which was patched by Microsoft in November 2024 and has also been weaponized in the wild in attacks targeting Ukraine and Colombia by threat actors like UAC-0194 and Blind Eagle.
606 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Spanish-speaking group targeting Latin American government, financial, and corporate organizations. Analysis of a compromised apparent attacker workstation exposed RAT-building tools, phishing templates, bulk-email software, infrastructure records, and efforts to evade security detection.
Suspected Blind Eagle operators conducted phishing campaigns impersonating Colombian judicial bodies and traffic authorities. The operation delivered remote-access malware through password-protected archives and multi-stage loaders hosted across code repositories, cloud storage, and other legitimate services.
Referenced only for comparison with the infostealer category and prior infrastructure patterns; the article does not attribute the described GitHub-loader and phishing operation to Blind Eagle.
A likely Colombia-based financially motivated threat actor conducting Spanish-language spear-phishing and spam campaigns against South American entities. It uses impersonated tax-authority and personal-photo lures, password-protected archives, URL shorteners with geographic and VPN filtering, and rotating remote-access trojans to compromise victims.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.