Blind Eagle Phishing Operations Exposed Through Compromised Operator Workstation

APT-C-36, also known as Blind Eagle, continued spear-phishing campaigns against Colombian and broader South American government, financial, healthcare, telecommunications, energy, and oil-and-gas organizations. The likely Colombia-based group used tax-authority, judicial, traffic-authority, and personal-infidelity lures to distribute password-protected PDF/DOCX-linked archives, with geographically filtered shortened URLs directing selected victims to hosted BitRAT and other remote-access malware. Researchers assess the activity is likely financially motivated rather than espionage-focused.

A LevelBlue investigation linked GitHub account cabeto850128, used to stage an AutoIt loader, to an email address exposed in ALIEN TXTBASE infostealer logs from a compromised device dubbed “Ghost.” Artifacts on that system included phishing templates, bulk-mail tools, RAT builds including AsyncRAT, DcRat, Remcos, and XWorm, and delivery infrastructure using GitHub, Bitbucket, AWS S3, actor-controlled domains, and DuckDNS. The reconstructed infection chain used self-extracting RAR archives, VBScript, concealed PowerShell, ProgramData-resident scripts, and InstallUtil.exe, with AsyncRAT-related traffic tied to dccomicrat81[.]duckdns.org; researchers cautioned that the evidence supports operational linkage but does not identify a real-world operator.