Loading story…
APT-C-36 has continued a long-running spam and spear-phishing campaign targeting organizations primarily in Colombia, with additional victims identified in Ecuador, Spain, and Panama. The activity has hit multiple sectors, including government, finance, healthcare, telecommunications, and energy, oil and gas, using Spanish-language lures to deliver malware through phishing emails.
Researchers reported that the group regularly changes its tradecraft to sustain access and reduce detection, rotating link shorteners and swapping in different commodity remote access trojans (RATs) as payloads. The campaign also uses geolocation filtering to narrow targeting and evade analysis, and its victimology and operational patterns indicate a motive aligned more with financial gain than traditional espionage.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
During the investigation, researchers observed APT-C-36 frequently changing its tactics, including rotating link shorteners, swapping remote access trojans and payloads, and using geolocation filtering to evade detection and refine targeting. Based on the victimology and tradecraft, the activity was assessed as more likely motivated by financial gain than espionage.
APT-C-36 conducted an ongoing campaign using Spanish-language spear-phishing emails to target organizations primarily in Colombia, with additional victims observed in Ecuador, Spain, and Panama. Affected sectors included government, financial services, healthcare, telecommunications, and energy, oil and gas.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT-C-36, also known as **Blind Eagle**, continued spear-phishing campaigns against Colombian and broader South American government, financial, healthcare, telecommunications, energy, and oil-and-gas organizations. The likely Colombia-based group used tax-authority, judicial, traffic-authority, and personal-infidelity lures to distribute password-protected PDF/DOCX-linked archives, with geographically filtered shortened URLs directing selected victims to hosted BitRAT and other remote-access malware. Researchers assess the activity is likely financially motivated rather than espionage-focused. A LevelBlue investigation linked GitHub account `cabeto850128`, used to stage an AutoIt loader, to an email address exposed in ALIEN TXTBASE infostealer logs from a compromised device dubbed “Ghost.” Artifacts on that system included phishing templates, bulk-mail tools, RAT builds including AsyncRAT, DcRat, Remcos, and XWorm, and delivery infrastructure using GitHub, Bitbucket, AWS S3, actor-controlled domains, and DuckDNS. The reconstructed infection chain used self-extracting RAR archives, VBScript, concealed PowerShell, ProgramData-resident scripts, and `InstallUtil.exe`, with AsyncRAT-related traffic tied to `dccomicrat81[.]duckdns.org`; researchers cautioned that the evidence supports operational linkage but does not identify a real-world operator.
Aug 31, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
A Brazilian cybercrime group tracked as **Augmented Marauder** and **Water Saci** is targeting Spanish-speaking users at organizations across Latin America and Europe with a multi-stage phishing campaign that delivers the **Casbaneiro** banking trojan and uses **Horabot** for delivery and propagation. The operation begins with court summons-themed phishing emails carrying password-protected PDF lures that direct victims to malicious links and ZIP archives, leading to execution of `HTA` and `VBS` payloads, followed by AutoIt loaders and encrypted malware components. Researchers said the malware chain includes anti-analysis checks, retrieval of additional payloads from remote servers, and dynamically generated judicial-themed PDF attachments created through a remote PHP API using random PINs. Horabot helps expand the campaign by harvesting Outlook contacts, abusing compromised email accounts, and sending new phishing messages, while the broader operation also incorporates **ClickFix** social engineering and **WhatsApp-based** distribution to evade defenses and widen infections.
Jun 29, 2026