BlindEagle Combines Geofenced Phishing With Commodity RATs
Summary
SOCRadar's profile details BlindEagle's Latin American espionage and credential-theft operations, including geofenced phishing, changing commodity RATs, multi-stage payload delivery, and reported use of a CVE-2024-43451 variant six days after patch release.
Key points
- Spanish-language phishing impersonates regional organizations; geofencing can show non-Latin American visitors benign pages while delivering droppers to targeted users.
- Campaigns use attachments such as obfuscated VBScript or SVG files to retrieve payloads, sometimes from trusted services, before loading RATs through process hollowing.
- The group rotates commodity RATs including AsyncRAT, Remcos, NjRAT, LimeRAT, and DCRAT; BlotchyQuasar is described as a modified Quasar RAT used to target banking credentials.
- A February 2025 exposure in a GitHub repository reportedly revealed thousands of records containing credentials and ATM PINs; the article says public reporting has not confirmed stolen funds or underground sales.
- In a September 2025 campaign against a Colombian ministry agency, a phishing email reportedly came from an internal shared account and stayed within the Microsoft 365 tenant, so SPF, DKIM, and DMARC checks were not applied.
- The article reports that BlindEagle used a CVE-2024-43451 variant six days after the patch release, using a WebDAV-trigger mechanism as a download-notification beacon.
- The article assesses Colombia as the primary target and reports activity extending to other Latin American countries and U.S. networks; it says nation-state attribution and links to a specific criminal organization remain unconfirmed.
Article Details
- Attack Vectors
- Spanish-language spear-phishing emails impersonating Colombian government, judiciary, and financial institutions deliver attachments or links.
- Geofenced links send non-Latin-American visitors to legitimate impersonated sites while directing Latin American visitors to dynamic-DNS-hosted droppers.
- Attachments include archives and SVG files with embedded JavaScript; a described chain used an obfuscated VBScript dropper, PowerShell, and payloads staged on public services.
- The September 2025 MCIT campaign used an SVG attachment to trigger PowerShell, retrieve an image, extract a .NET payload, and deliver DCRAT.
- The group has used DLL side-loading and process hollowing to load payloads, including commodity RATs.
- The article reports weaponization of CVE-2024-43451 six days after its patch release, using a WebDAV-triggered outbound authentication request as a download-notification beacon.
- Defensive Notes
- Patch newly disclosed Windows shell vulnerabilities promptly; the article reports BlindEagle weaponized CVE-2024-43451 within six days of the patch release.
- Monitor for Spanish-language phishing, impersonation of local institutions, geofenced links, and suspicious attachments including SVG files and compressed archives.
- Account for geofencing when analyzing links and samples, since non-Latin-American locations may receive benign content.
- Monitor for the article-listed dynamic-DNS delivery domains and for payload staging or retrieval involving public file-sharing services.
- Review exposed email gateways, Microsoft 365 tenant configuration, and internal email workflows for abuse of trusted organizational accounts.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationDroppers are padded with junk data, and payloads are Base64-encoded or hidden inside images.T1036 · MasqueradingPhishing emails and pages impersonate organizations including DIAN, Fiscalia, and Colombia's Ministry of Foreign Affairs.T1055.012 · Process HollowingThe article describes final RAT payloads being loaded into memory through process hollowing.T1056.001 · KeyloggingBlotchyQuasar activates keylogging when a victim navigates to targeted Colombian and Ecuadorian banking portals.T1059.001 · PowerShellPowerShell builds an in-memory script in one chain and is triggered by an SVG attachment in the September 2025 MCIT campaign.T1059.005 · Visual BasicA described infection chain uses an obfuscated VBScript dropper named sostener.vbs to decode and launch the next stage.T1105 · Ingress Tool TransferCampaign chains retrieve second-stage components and payloads from services including Internet Archive, paste[.]ee, and Discord CDN.T1113 · Screen CaptureRAT deployments provide screenshot capture for surveillance of high-value government targets.T1123 · Audio CaptureThe article reports RAT deployments with microphone access for surveillance.T1125 · Video CaptureThe article reports RAT deployments with webcam access for surveillance.T1204.002 · Malicious FileThe infection chain depends on a victim opening a malicious attachment or clicking a phishing link.T1480 · Execution GuardrailsGeofencing redirects non-Latin-American visitors to legitimate impersonated sites while delivering droppers to Latin American visitors.T1566.001 · Spearphishing AttachmentBlindEagle sends Spanish-language spear-phishing emails with attachments including PDF, DOCX, archives, and SVG files.T1566.002 · Spearphishing LinkThe group uses embedded phishing links routed through URL shorteners and geofencing logic.T1574.002 · DLL Side-LoadingA campaign against Colombian judicial bodies used DLL side-loading to initiate infection and load a final payload.
CVE
People
Pjoao1578A crypter author documented by previous research as having developed crypters used by BlindEagle; the article says this person is likely a Brazilian developer.RodaA crypter author whose crypter was used by BlindEagle, according to previous research cited in the article; one of Roda's crypters contained a hardcoded server that also hosted campaign components.
Threat Actors
Blind EagleThe article identifies APT-C-36 as another name for BlindEagle and attributes the same reported cyber activity to the group.BlindEagleThe article attributes phishing, espionage, credential theft, and deployment of commodity RATs to BlindEagle.G0099The article lists G0099 as an identifier for BlindEagle and attributes the same reported cyber activity to the group.Red AkodonThe article says Red Akodon overlaps with BlindEagle through shared cracked AsyncRAT samples, but is not formally identical to the group.
Malware
AsyncRAT#BlindEagleBitRAT[T1219 ] Remote Access Software – BlindEagle repeatedly deploys RATs such as AsyncRAT, Remcos, njRAT, LimeRAT, BitRAT, Warzone RAT, DCRAT, and Imminent Monitor (‘relying almost entirely on cracked commodity RATs’).BlotchyQuasar#BlindEagleCaminho#BlindEagleDCRat#BlindEagleImminent Monitor[T1219 ] Remote Access Software – BlindEagle repeatedly deploys RATs such as AsyncRAT, Remcos, njRAT, LimeRAT, BitRAT, Warzone RAT, DCRAT, and Imminent Monitor (‘relying almost entirely on cracked commodity RATs’).LimeRAT#BlindEaglenjRAT#BlindEagleRemcos#BlindEagleWarzone RAT[T1219 ] Remote Access Software – BlindEagle repeatedly deploys RATs such as AsyncRAT, Remcos, njRAT, LimeRAT, BitRAT, Warzone RAT, DCRAT, and Imminent Monitor (‘relying almost entirely on cracked commodity RATs’).
Products
GitHubIn February 2025, a mistakenly exposed GitHub HTML file revealed thousands of stolen PII records, including usernames, passwords, email credentials, and ATM PINs.Microsoft 365 Apps for EnterpriseBecause the message stayed entirely within the organization’s Microsoft 365 tenant, SPF, DKIM, and DMARC checks were never applied at all, making the email indistinguishable from normal internal communication.Microsoft WindowsThis compresses the defender’s patch window from weeks to days for any newly disclosed Windows shell vulnerability.
Tools
Ande LoaderIn a March 2024 campaign targeting Spanish-speaking manufacturers in North America, the group used Ande Loader to deliver Remcos RAT and NjRAT through RAR and BZ2 archives.HeartCryptWith no in-house malware, the group infected thousands of endpoints by composing cracked AsyncRAT and Remcos with packers like HeartCrypt, commercial loaders, and culturally tuned lures.HijackLoadercontained a clean executable that initiated infection through side-loading, alongside a loader called HijackLoader, which decrypted and loaded the final payload.
Countries
ChileSecondary targets are Ecuador, Chile, Panama, and Spain, with extensions in 2024 into Spanish-speaking organizations in North America.ColombiaBlindEagle (APT-C-36 / AguilaCiega / TAG-144 / G0099 / APT-Q-98) is a Latin America–based threat actor that blends espionage and cybercrime, with a strong focus on Colombia and a growing spillover into the U.S.EcuadorSecondary targets are Ecuador, Chile, Panama, and Spain, with extensions in 2024 into Spanish-speaking organizations in North America.PanamaSecondary targets are Ecuador, Chile, Panama, and Spain, with extensions in 2024 into Spanish-speaking organizations in North America.SpainSecondary targets are Ecuador, Chile, Panama, and Spain, with extensions in 2024 into Spanish-speaking organizations in North America.United StatesBlindEagle (APT-C-36 / AguilaCiega / TAG-144 / G0099 / APT-Q-98) is a Latin America–based threat actor that blends espionage and cybercrime, with a strong focus on Colombia and a growing spillover into the U.S.
Industries
BankingThe group relies on phishing, geofenced delivery, commodity RATs, and rapid weaponization of public vulnerabilities to steal banking credentials and sensitive government data.GovernmentThe group relies on phishing, geofenced delivery, commodity RATs, and rapid weaponization of public vulnerabilities to steal banking credentials and sensitive government data.InsuranceThe insurance sector has also been targeted within this financial track.JudiciaryBlindEagle runs a hybrid operation: financial theft focuses on banking credentials, while espionage targets Colombian government, judiciary, and peace-negotiation institutions.ManufacturingThe phishing lures were still in Spanish, aimed at Spanish-speaking employees working in North American manufacturing firms.