BlindEagle Uses Caminho Downloader to Deploy DCRAT Against Colombian Government Agency
Summary
ThreatLabz details a BlindEagle spear-phishing campaign against a Colombian government agency, using a likely compromised email account, a fake judicial portal, obfuscated scripts, Caminho, and DCRAT.
Key points
- The campaign targeted a Colombian government agency under the Ministry of Commerce, Industry and Tourism; the phishing email was likely sent from a compromised account within the agency.
- A legal-themed SVG attachment opened a fake Colombian judicial portal that prompted the recipient to download a file.
- Obfuscated JavaScript and PowerShell downloaded an image containing a concealed payload, which was loaded in memory.
- Caminho acted as a downloader, retrieving a payload hosted on Discord and executing it through process hollowing in MSBuild.exe.
- The final payload was DCRAT, a C# remote access trojan with capabilities including keylogging, disk access, and AMSI patching.
- ThreatLabz identified 24 hosts with certificates sharing an issuer with the DCRAT sample, but cautioned that only some may be linked to this campaign.
Article Details
- Attack Vectors
- A phishing email, apparently sent from a compromised account within the targeted Colombian agency, directed the recipient to open an SVG attachment.
- The clickable SVG decoded and opened an embedded HTML page that mimicked a Colombian judicial portal and automatically downloaded a JavaScript file.
- The JavaScript chain deobfuscated and executed further scripts, which launched PowerShell through WMI.
- PowerShell downloaded an image from the Internet Archive and extracted a Base64-encoded payload embedded between markers.
- Caminho downloaded AGT27.txt from a Discord attachment URL, decoded it in memory, and used process hollowing to run DCRAT inside MSBuild.exe.
- Defensive Notes
- ThreatLabz reports that the sender and recipient domains had DMARC, DKIM, and SPF configured, but those checks were not applied to the intra-tenant email.
- Monitor for unexpected JavaScript and PowerShell execution, WMI process creation, image downloads followed by payload extraction, and process hollowing involving MSBuild.exe.
- ThreatLabz says its cloud security platform detects indicators related to DCRAT and BlindEagle.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | startmenuexperiencehost[.]ydns[.]eu | Identified in the article as a DCRAT C2 domain. |
| MD5 | 4284e99939cebf40b8699bed31c82fd6 | MD5 hash of the PNG image used in the attack. |
| MD5 | 961ebce4327b18b39630bfc4edb7ca34 | MD5 hash of the JavaScript file in the attack. |
| MD5 | 9799484e3942a6692be69aec1093cb6c | MD5 hash of the Caminho instance identified in the attack. |
| MD5 | 97adb364d695588221d0647676b8e565 | MD5 hash of the DCRAT instance delivered in the attack. |
| MD5 | bbb99dfd9bf3a2638e2e9d13693c731c | MD5 hash of the AGT27.txt text file used in the attack. |
| MD5 | c98eb5fcddf0763c7676c99c285f6e80 | MD5 hash of the fraudulent web portal used in the phishing attack. |
| MD5 | d80237d48e1bbc2fdda741cbf006851a | MD5 hash of the phishing SVG attachment. |
| SHA1 | 21e95fed5fc5c4a10fafbc3882768cce1f6cd7af | SHA1 hash of the PNG image used in the attack. |
| SHA1 | 38b0e360d58d4ddb17c0a2c4d97909be43a3adc0 | SHA1 hash of the DCRAT instance delivered in the attack. |
| SHA1 | 3983a5b4839598ba494995212544da05087b811b | SHA1 hash of the JavaScript file in the attack. |
| SHA1 | 3ab2aa4e9a7a8abcf1ea42b51152f6bb15a1b3c5 | SHA1 hash of the fraudulent web portal used in the phishing attack. |
| SHA1 | 4397920a0b08a31284aff74a0bed9215d5787852 | SHA1 hash of the AGT27.txt text file used in the attack. |
| SHA1 | 722a4932576734a08595c7196d87395e6ec653d7 | SHA1 hash of the phishing SVG attachment. |
| SHA1 | b3fb8a805d3acc2eda39a83a14e2a73e8b244cf4 | SHA1 hash of the Caminho instance identified in the attack. |
| SHA256 | 03548c9fad49820c52ff497f90232f68e044958027f330c2c51c80f545944fc1 | SHA256 hash of the fraudulent web portal used in the phishing attack. |
| SHA256 | 08a5d0d8ec398acc707bb26cb3d8ee2187f8c33a3cbdee641262cfc3aed1e91d | SHA256 hash of the PNG image used in the attack. |
| SHA256 | 8f3dc1649150961e2bac40d8dabe5be160306bcaaa69ebe040d8d6e634987829 | SHA256 hash of the phishing SVG attachment. |
| SHA256 | c208d8d0493c60f14172acb4549dcb394d2b92d30bcae4880e66df3c3a7100e4 | SHA256 hash of the Caminho instance identified in the attack. |
| SHA256 | d0fe6555bc72a7a45a836ea137850e6e687998eb1c4465b8ad1fb6119ff882ab | SHA256 hash of the JavaScript file in the attack. |
| SHA256 | d139bfe642f3080b461677f55768fac1ae1344e529a57732cc740b23e104bff0 | SHA256 hash of the AGT27.txt text file used in the attack. |
| SHA256 | e7666af17732e9a3954f6308bc52866b937ac67099faa212518d5592baca5d44 | SHA256 hash of the DCRAT instance delivered in the attack. |
| URL | hxxps[:]//archive[.]org/download/optimized_msi_20250821/optimized_MSI[.]png' | Download URL for the image from which the attack's PowerShell script extracts an encoded payload. |
| URL | hxxps[:]//cdn[.]discordapp[.]com/attachments/1402685029678579857/1410251798123511808/AGT27[.]txt?ex=68b056d5&is=68af0555&hm=3ef2cf8f65a9a6f4955ecd0292af0cd68e65864907d07543c416ab28a2acfa6d& | Discord attachment URL from which Caminho downloads the AGT27.txt payload. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe attack used obfuscated JavaScript and Base64-encoded, reversed payload content.T1027.003 · SteganographyThe article describes steganography to conceal malicious payloads in the attack chain.T1047 · Windows Management InstrumentationThe JavaScript stage used WMI and Win32_Process.Create() to execute the PowerShell command.T1055.012 · Process HollowingCaminho used process hollowing to run the DCRAT payload in MSBuild.exe.T1059.001 · PowerShellA PowerShell command downloaded an image and extracted and loaded its encoded payload.T1059.007 · JavaScriptJavaScript files deobfuscated and advanced the attack chain.T1105 · Ingress Tool TransferPowerShell downloaded an image payload and Caminho downloaded AGT27.txt from Discord.T1204.002 · Malicious FileThe attack chain began when the recipient opened the downloaded fraudulent receipt.T1566.001 · Spearphishing AttachmentBlindEagle used a phishing email with an SVG attachment to initiate the attack.T1620 · Reflective Code LoadingPowerShell decoded a payload and dynamically loaded it as a .NET assembly using reflection.
Threat Actors
Malware
AsyncRATvariety of features including keylogging, disk access, and more. It is one of the prevalent variants of AsyncRAT, but distinguishes itself with new capabilities, such as patching Microsoft’s Antimalware Scan InterfaceCaminhofake web portal, nested JavaScript and PowerShell scripts, steganography to conceal malicious payloads, Caminho as a downloader, and DCRAT as the final payload.DCRatand PowerShell scripts, steganography to conceal malicious payloads, Caminho as a downloader, and DCRAT as the final payload.VMDetectLoaderloaded by the PowerShell command in the attack chain as a malware downloader known as Caminho (and VMDetectLoader), which can be traced back to May 2025. BlindEagle was one of the early adopters of Caminho, likelyXWormthat time, Caminho has been utilized by several threat actors to deliver a variety of malware, including XWorm.
Vendors
Microsoftand didn’t include any suspicious hops. All the “Received” headers referenced servers belonging to Microsoft 365 / Exchange, including the originating server.ZscalerIn early September 2025, Zscaler ThreatLabz discovered a new spear phishing campaign attributed to BlindEagle, a threat actor who operates in South America and targets users in Spanish-speaking countries, such as
Products
Discordexplore how BlindEagle’s campaign leverages in-memory scripts, legitimate internet services like Discord, steganography, and the deployment of Caminho and DCRAT. The analysis breaks down the methods and toolsInternet ArchiveThis command is designed to download an image file from the Internet Archive. Once downloaded, the script carves out a Base64-encoded payload embedded between two specific markers: BaseStart- and -BaseEnd. An example ofMicrosoft 365and didn’t include any suspicious hops. All the “Received” headers referenced servers belonging to Microsoft 365 / Exchange, including the originating server.Microsoft Exchange Serverinclude any suspicious hops. All the “Received” headers referenced servers belonging to Microsoft 365 / Exchange, including the originating server.Microsoft WindowsThe goal of the third JavaScript stage is to execute a PowerShell command. Specifically, it leverages Windows Management Instrumentation (WMI) to obtain a Win32_Process instance. The PowerShell command is executed viaMsBuild.exeis then executed using a technique known as process hollowing, where a legitimate Windows utility, MSBuild.exe, is launched and hollowed out to host the malicious code. The payload injected in this case is a DCRATZscaler Cloud SandboxZscaler’s multilayered cloud security platform detects indicators related to DCRAT at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for DCRAT.