Loading story…
Blind Eagle, also known as APT-C-36, has targeted Latin American organizations since 2018, particularly Colombian government institutions, financial organizations and critical infrastructure. A campaign reported as ongoing since November 2024 used phishing links and malicious files requiring minimal user interaction to retrieve malware through WebDAV. Unlike attacks exploiting CVE-2024-43451 to harvest NTLMv2 hashes, the reported activity used this delivery mechanism to download malware.
In late February 2025, Darktrace observed a compromise at a Colombian customer and attributed it to Blind Eagle with medium confidence. Within five hours, the affected device downloaded executables, contacted suspicious infrastructure and uploaded 60 MiB and 5.6 MiB to two external endpoints; the reported evidence does not establish what those uploads contained. Automated containment was not enabled, and the compromise continued until the customer's security team responded to alerts. Defenders should prioritize monitoring unusual WebDAV downloads, subsequent executable activity and outbound uploads, and assess whether automated containment can shorten response times.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
The observed attack progressed from suspicious redirection and executable downloads to data exfiltration within approximately five hours. Darktrace recorded uploads of 60 MiB to 21ene.ip-ddns[.]com and 5.6 MiB to diciembrenotasenclub[.]longmusic[.]com, followed by continued beaconing.
In late February 2025, Darktrace observed a compromise in a Colombian customer's network and attributed it to Blind Eagle with medium confidence. The affected device downloaded an executable from 62[.]60[.]226[.]112 and subsequently contacted suspicious infrastructure, including 21ene.ip-ddns[.]com.
Microsoft patched the Windows vulnerability that could disclose NTLMv2 password hashes following minimal interaction with a malicious file. The described Blind Eagle campaign retained a minimal-interaction delivery mechanism after the patch, using it to deliver malware rather than harvest hashes.
A campaign targeting Colombian organizations began in November 2024. Phishing links delivered malicious files that triggered WebDAV requests and retrieved malware following minimal user interaction.
Blind Eagle, also known as APT-C-36, has been observed conducting cyberattacks across Latin America since 2018, particularly targeting Colombian government institutions, financial organizations, and critical infrastructure.
Darktrace generated alerts and correlated suspicious downloads, command-and-control connections, and external data transfers into a broader incident. Autonomous response was not enabled, so the compromise continued until the customer's security team responded.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blind Eagle, also tracked as **TAG-144**, **APT-C-36**, and linked by some researchers to **Red Akodon**, continued targeting organizations across South America with a sustained emphasis on Colombian government entities at the local, municipal, and federal levels. Researchers described multi-stage intrusion chains using spearphishing, including compromised Colombian government email accounts, to deliver commodity and cracked remote access trojans through exposed Apache staging servers, dynamic DNS infrastructure, and legitimate internet services used for payload staging. The group has remained active since at least 2018, blending credential theft, financial crime, and surveillance-oriented collection against public-sector targets. Recent activity shows the actor refining rather than replacing its established toolkit. Investigators observed VBScript-to-PowerShell delivery chains, steganography to conceal payloads in image files, a new JavaScript stage with custom AES-based string obfuscation, an AutoIt3 RunPE loader fetched from `raw.githubusercontent.com`, and repeated use of the **"Photo Studio"** persistence disguise. The most significant upgrade was a new AsyncRAT variant, **JC-46**, which adds WNF-based process injection, custom Base28 encoding, HVNC support for banking fraud, browser profile cloning, and a bypass for Chrome App-Bound Encryption v20, while the group continued reusing VPN-linked command-and-control infrastructure and familiar dynamic DNS patterns.
Jul 17, 2026
BlindEagle, a South American threat group, orchestrated a sophisticated phishing campaign targeting Colombian government agencies, specifically those under the Ministry of Commerce, Industry and Tourism (MCIT). The attackers leveraged compromised internal email accounts to send convincing phishing emails that impersonated the Colombian judicial system, using legal terminology and official formatting to increase credibility and urgency. The emails contained SVG attachments with encoded HTML, leading recipients to a fraudulent web portal designed to mimic the legitimate judicial branch. The attack chain was highly complex and file-less, involving multiple stages of JavaScript execution and PowerShell commands, with each stage using advanced obfuscation techniques such as Base64 and custom algorithms to evade detection. Zscaler analysts identified that the campaign represented a significant escalation in BlindEagle's tactics, moving beyond basic malware to a multi-stage, stealthy infection process that exploited trust relationships within the targeted organizations. The campaign highlights the evolving threat posed by BlindEagle to government entities in Colombia.
Jun 29, 2026
APT-C-36, also known as **Blind Eagle**, continued spear-phishing campaigns against Colombian and broader South American government, financial, healthcare, telecommunications, energy, and oil-and-gas organizations. The likely Colombia-based group used tax-authority, judicial, traffic-authority, and personal-infidelity lures to distribute password-protected PDF/DOCX-linked archives, with geographically filtered shortened URLs directing selected victims to hosted BitRAT and other remote-access malware. Researchers assess the activity is likely financially motivated rather than espionage-focused. A LevelBlue investigation linked GitHub account `cabeto850128`, used to stage an AutoIt loader, to an email address exposed in ALIEN TXTBASE infostealer logs from a compromised device dubbed “Ghost.” Artifacts on that system included phishing templates, bulk-mail tools, RAT builds including AsyncRAT, DcRat, Remcos, and XWorm, and delivery infrastructure using GitHub, Bitbucket, AWS S3, actor-controlled domains, and DuckDNS. The reconstructed infection chain used self-extracting RAR archives, VBScript, concealed PowerShell, ProgramData-resident scripts, and `InstallUtil.exe`, with AsyncRAT-related traffic tied to `dccomicrat81[.]duckdns.org`; researchers cautioned that the evidence supports operational linkage but does not identify a real-world operator.
Aug 31, 2026