Loading story…
APT-C-36, also known as Blind Eagle, continued spear-phishing campaigns against Colombian and broader South American government, financial, healthcare, telecommunications, energy, and oil-and-gas organizations. The likely Colombia-based group used tax-authority, judicial, traffic-authority, and personal-infidelity lures to distribute password-protected PDF/DOCX-linked archives, with geographically filtered shortened URLs directing selected victims to hosted BitRAT and other remote-access malware. Researchers assess the activity is likely financially motivated rather than espionage-focused.
A LevelBlue investigation linked GitHub account cabeto850128, used to stage an AutoIt loader, to an email address exposed in ALIEN TXTBASE infostealer logs from a compromised device dubbed “Ghost.” Artifacts on that system included phishing templates, bulk-mail tools, RAT builds including AsyncRAT, DcRat, Remcos, and XWorm, and delivery infrastructure using GitHub, Bitbucket, AWS S3, actor-controlled domains, and DuckDNS. The reconstructed infection chain used self-extracting RAR archives, VBScript, concealed PowerShell, ProgramData-resident scripts, and InstallUtil.exe, with AsyncRAT-related traffic tied to dccomicrat81[.]duckdns.org; researchers cautioned that the evidence supports operational linkage but does not identify a real-world operator.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
The cabeto850128 account created the jacobo repository containing archivo.zip. Researchers later noted that the repository reused the archivo.zip filename with different content.
The cabeto850128 account resumed activity and created the comicsam repository, later identified as hosting components of an AutoIt-based malware loader.
The GitHub account cabeto850128 was created with a placeholder repository named test.
APT-C-36, also known as Blind Eagle, had targeted organizations in Colombia and other South American countries through spam and spear-phishing campaigns since at least 2019.
Analysis of matched samples found self-extracting RAR archives launching VBScript and obfuscated PowerShell, writing scripts to ProgramData, and abusing InstallUtil.exe. The reconstructed infrastructure used GitHub and alternate Bitbucket or AWS S3 staging, with AsyncRAT traffic associated with dccomicrat81[.]duckdns.org and per-build delivery paths on creainovada[.]xyz.
Researchers linked cabeto850128 GitHub commit metadata to an email address found in ALIEN TXTBASE stealer logs and associated with an infostealer-compromised device named Ghost. Recovered artifacts included RAT build folders, Colombian government-themed phishing templates, and bulk-email tooling, though the evidence did not establish an operator's identity.
APT-C-36 used DIAN tax and personal-infidelity lures with password-protected PDF or DOCX attachments and geofiltered shortened URLs to deliver BitRAT archives. The activity primarily targeted Colombian organizations, with additional targets in Ecuador, Spain, and Panama across government, financial, healthcare, telecommunications, energy, oil, and gas sectors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcelevelblue.com
Open sourcetrendaisecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blind Eagle, also tracked as **TAG-144**, **APT-C-36**, and linked by some researchers to **Red Akodon**, continued targeting organizations across South America with a sustained emphasis on Colombian government entities at the local, municipal, and federal levels. Researchers described multi-stage intrusion chains using spearphishing, including compromised Colombian government email accounts, to deliver commodity and cracked remote access trojans through exposed Apache staging servers, dynamic DNS infrastructure, and legitimate internet services used for payload staging. The group has remained active since at least 2018, blending credential theft, financial crime, and surveillance-oriented collection against public-sector targets. Recent activity shows the actor refining rather than replacing its established toolkit. Investigators observed VBScript-to-PowerShell delivery chains, steganography to conceal payloads in image files, a new JavaScript stage with custom AES-based string obfuscation, an AutoIt3 RunPE loader fetched from `raw.githubusercontent.com`, and repeated use of the **"Photo Studio"** persistence disguise. The most significant upgrade was a new AsyncRAT variant, **JC-46**, which adds WNF-based process injection, custom Base28 encoding, HVNC support for banking fraud, browser profile cloning, and a bypass for Chrome App-Bound Encryption v20, while the group continued reusing VPN-linked command-and-control infrastructure and familiar dynamic DNS patterns.
Jul 17, 2026
BlindEagle, a South American threat group, orchestrated a sophisticated phishing campaign targeting Colombian government agencies, specifically those under the Ministry of Commerce, Industry and Tourism (MCIT). The attackers leveraged compromised internal email accounts to send convincing phishing emails that impersonated the Colombian judicial system, using legal terminology and official formatting to increase credibility and urgency. The emails contained SVG attachments with encoded HTML, leading recipients to a fraudulent web portal designed to mimic the legitimate judicial branch. The attack chain was highly complex and file-less, involving multiple stages of JavaScript execution and PowerShell commands, with each stage using advanced obfuscation techniques such as Base64 and custom algorithms to evade detection. Zscaler analysts identified that the campaign represented a significant escalation in BlindEagle's tactics, moving beyond basic malware to a multi-stage, stealthy infection process that exploited trust relationships within the targeted organizations. The campaign highlights the evolving threat posed by BlindEagle to government entities in Colombia.
Jun 29, 2026
Multiple reporting described **phishing-led intrusions** that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters **APT36/Transparent Tribe** and **SideCopy**, using malicious attachments/links to deliver Windows and Linux payloads including **Geta RAT**, **Ares RAT**, and **DeskRAT**. One documented Windows chain used a malicious `LNK` that invoked `mshta.exe` to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms. Separately, a newly reported **CrashFix** campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary **Python implant** plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and **Active Directory** targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new **XWorm** variant via a malicious Excel attachment exploiting `CVE-2018-0802` to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into `Msbuild.exe`, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.
Jun 29, 2026