Blind Eagle (APT-C-36) is the most persistent targeted threat to Colombian government bodies and banks, and it does it with commodity remote access trojans, compromised government mailboxes and lures that look like tax, court and prosecutor notices. It switches between espionage and financial credential theft, sometimes within the same period, which makes it hard to place in the usual state or criminal box. This profile is for SOC analysts, email security teams, fraud teams and intelligence staff in Colombia, Ecuador and the wider Latin American region, and for any organisation that handles Spanish-language mail from those governments. It covers names and attribution as each source states them, targeting, ATT&CK techniques, how the group steals and reuses identities, notable campaigns and a detection and hardening plan. General background is in the Threat Actor Groups Guide.
Key takeaways
- It lives off trusted senders. ATT&CK and Recorded Future report regular use of compromised email accounts, including Colombian government and judicial addresses, and a compromised regional government Google Drive used to host payloads.
- Lures impersonate authority. Kaspersky lists DIAN (the tax and customs authority), the Ministry of Foreign Affairs, the Attorney General's Office and judicial institutions; phishing pages copy Bancolombia, BBVA and Davivienda.
- The tooling is cheap but varied. Modified njRAT, AsyncRAT, Remcos, DcRAT, LimeRAT and Quasar variants, packed with crypters such as HeartCrypt and PureCrypter.
- It is fast to adopt new tricks. Check Point saw a .url file technique related to CVE-2024-43451 six days after Microsoft patched it in November 2024; one December 2024 campaign reached more than 1,600 victims.
- Geofencing hides it from outsiders. Delivery links redirect anyone outside Colombia or Ecuador to the real impersonated site, so scanning from abroad often shows nothing.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as APT-C-36 (G0099), a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018, targeting government institutions and the financial, energy and manufacturing sectors across Colombia and other Latin American countries. Check Point says the group has long been suspected to originate from South America and noted repository commit timestamps in UTC-5. Recorded Future states that the group's origin remains uncertain, that some research points to Colombia, and that its use of Brazilian criminal tools suggests a possible link to Brazilian actors. No government attribution has been published in the sources reviewed.
| Name | Tracked by | Notes |
|---|---|---|
| APT-C-36 | Qihoo 360 / QiAnXin (2019), ATT&CK | First public report described attacks on Colombian government and companies |
| Blind Eagle, AguilaCiega | Kaspersky, Check Point; listed in ATT&CK | Most common public name in English and Spanish |
| TAG-144 | Recorded Future Insikt Group | Five activity clusters from 2024 to 2025; linked to the Red Akodon cluster |
| APT-Q-98 | Listed in ATT&CK | Vendor alias |
Targeting and motivation
- Colombia first: Kaspersky found Colombia accounted for 87% of victims in its May and June 2024 espionage campaigns. Recorded Future describes victims at local, municipal and federal government level.
- Justice system: Check Point's December 2024 and January 2025 lures pointed mainly at the Colombian justice system.
- Region: Ecuador, Chile and Panama also appear in Kaspersky's reporting.
- Sectors: government, banking and finance, energy and oil and gas, with education, health, transport, retail and defence also hit (Kaspersky, Recorded Future).
- Motivation: both. Kaspersky saw modified njRAT used for espionage and a modified Quasar used as a banking trojan; Recorded Future says it is unclear whether the activity is financially motivated, state-sponsored espionage or both.
Tactics and techniques (MITRE ATT&CK)
All techniques below are mapped to G0099 in ATT&CK v20. Software mapped to the group includes njRAT (S0385), AsyncRAT (S1087), Remcos (S0332), QuasarRAT (S0262, including the BlotchyQuasar variant), Imminent Monitor (S0434), DCRAT (S9017), Caminho (S9016), PureCrypter (S9019) and HeartCrypt (S9018).
| Tactic | Technique | How it shows up |
|---|---|---|
| Reconnaissance | T1593 Search Open Websites/Domains | Research on Colombian banks to build phishing pages |
| Resource development | T1586.002 Email Accounts; T1586.003 Cloud Accounts | Compromised mailboxes and a government-linked Google Drive |
| Resource development | T1583.006 Web Services; T1608.001 Upload Malware | Payloads on GitHub, Bitbucket, Google Drive, Dropbox, Discord, Pastebin and image hosts |
| Resource development | T1683.001 Written Content; T1684.001 Impersonation | Notices that copy DIAN, prosecutors, courts and banks |
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link | PDF and DOCX lures, password-protected RAR files, shortened links |
| Lateral movement | T1534 Internal Spearphishing | A compromised account mailing an address likely monitored by the victim's IT team |
| Execution | T1059.005 Visual Basic; T1059.007 JavaScript; T1059.001 PowerShell; T1047 WMI | Script chains, PowerShell started through WMI |
| Persistence | T1053.005 Scheduled Task; T1036.004 Masquerade Task or Service | Tasks disguised as Google tasks |
| Stealth | T1480 Execution Guardrails | Geolocation filtering that sends non-targets to legitimate sites |
| Stealth | T1027.003 Steganography; T1027.013 Encrypted/Encoded File; T1564.003 Hidden Window | Code hidden in images; hidden PowerShell windows |
| Stealth, privilege escalation | T1055.012 Process Hollowing; T1574.001 DLL side-loading | Injection into legitimate processes; HijackLoader side-loaded |
| Command and control | T1568 Dynamic Resolution; T1571 Non-Standard Port | DuckDNS, No-IP and con-ip domains; C2 on port 4050 |
How they abuse identities and credentials
Identity is central to Blind Eagle on both sides of the attack: it borrows the identity of government senders to get in, and it steals banking and system credentials once it is there.
| Identity abused | What the actor does | Control that limits it |
|---|---|---|
| Government mailboxes | Phishing sent from compromised mayor's office and judicial-branch accounts (Recorded Future) | Phishing-resistant MFA for public sector mail, mailbox audit logging, inbound scanning that does not trust a sender because the domain is .gov.co |
| Cloud storage accounts | Payloads hosted in a compromised regional government Google Drive (ATT&CK, Recorded Future) | Treat shared-drive download links in mail as untrusted; report abuse quickly to the provider |
| Online banking credentials | Modified Quasar starts keylogging when a browser title matches one of ten Colombian financial entities (Kaspersky); fake bank login portals | Bank-side device binding and transaction signing; customer anti-phishing messaging; monitoring of lookalike domains |
| Internal IT trust | Mail from a compromised account to an address watched by the IT team (ATT&CK) | Treat internal mail with attachments as untrusted; flag mail to shared IT mailboxes with archives |
| Remote sessions | Modified njRAT can create RDP sessions (Kaspersky) | Restrict RDP to managed jump hosts, enforce Network Level Authentication and MFA |
| NTLM authentication | .url files that make WebDAV requests when a file is touched; Check Point says SMB signing and NTLM relay protections matter for the original CVE | Block outbound SMB and WebDAV to the internet, enforce SMB signing, patch CVE-2024-43451 |
For the NTLM side, see the NTLM Relay Guide and the SMB Signing Guide. For mailbox takeover response, see the Account Takeover Response Playbook.
Notable incidents
| Date | Activity | Source |
|---|---|---|
| 2018 onward | Attacks on Colombian government institutions and companies | Qihoo 360 / QiAnXin, February 2019, via ATT&CK |
| May to June 2024 | Espionage campaigns with DIAN and judicial lures; HijackLoader and AsyncRAT; Portuguese strings in one campaign | Kaspersky, 19 August 2024 |
| May 2024 to July 2025 | Five TAG-144 clusters using AsyncRAT, Remcos, DcRAT and LimeRAT against Colombian government entities | Recorded Future, August 2025 |
| November 2024 | .url technique related to CVE-2024-43451 seen six days after the patch | Check Point, 10 March 2025 |
| December 2024 | More than 1,600 victims in one campaign and about 9,000 infections across December campaigns | Check Point |
| February 2025 | Actor briefly posted stolen phishing data to its own GitHub repository | Check Point |
Detection and defence
Detection signals
| Signal | Where to look | Notes |
|---|---|---|
| Spanish-language legal, tax or court notices with links to Google Drive, Dropbox, GitHub or Bitbucket | Mail gateway, URL detonation | Detonate from a Colombian egress point if possible, because of geofencing |
| Password-protected archives with the password in the email body | Mail gateway | Used to get past attachment scanning |
| .url files in downloads or mail, and WebDAV requests from explorer.exe | EDR file and network events, proxy logs | The CVE-2024-43451 related technique |
| wscript.exe or PowerShell launched by WMI with hidden windows | Sysmon Event ID 1, WMI activity logs | Script chain |
| Scheduled tasks named like Google updaters that point to user-writable paths | Event ID 4698, autoruns baselines | Masquerading persistence |
| Endpoints resolving DuckDNS, No-IP or con-ip domains | DNS logs, protective DNS | Block where not needed |
| Outbound connections on port 4050 or other unusual ports | Firewall and NetFlow | RAT C2 |
| Mailbox sending to unusual internal or external recipients after a sign-in from a VPN provider | Identity provider and mail audit logs | Compromised sender accounts |
Hardening plan
- Week 1: load current Kaspersky, Check Point and Recorded Future indicators into DNS and mail filters, and block dynamic DNS domains at the resolver where the business does not need them. See the Protective DNS Guide.
- Weeks 2 to 4: quarantine password-protected archives and .url, .vbs, .js and .lnk attachments at the gateway; patch CVE-2024-43451 (in the CISA KEV catalogue) and block outbound SMB and WebDAV.
- Weeks 4 to 8: apply application control or attack surface reduction rules to stop script hosts launched from mail and downloads, in audit mode first, then enforce by department with a documented rollback.
- Quarter 1: enforce phishing-resistant MFA on government and partner-facing mailboxes, enable mailbox audit logs and alert on new inbox rules and unusual sending. Banks should add transaction signing and lookalike domain takedown.
- Response: isolate, reimage, rotate the user's banking, mail and VPN credentials, and check whether the mailbox was then used to phish others. Tell partners if your domain sent lures.
Metrics
- Password-protected archives delivered to users per month: zero outside approved senders.
- Endpoints resolving dynamic DNS domains: trending to zero.
- Government-facing mailboxes on phishing-resistant MFA: 100%.
- Time from compromised sender report to mailbox lockdown: under one hour.
- Script host launches from mail or download folders blocked: 100% after enforcement.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SI-8 Spam Protection, SI-3 Malicious Code Protection | Mail filtering of lures and archives |
| NIST SP 800-53 Rev. 5 | IA-2 Identification and Authentication, AC-2 Account Management | Mailbox MFA and compromised account handling |
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection, SI-4 System Monitoring | Blocking outbound SMB, WebDAV and dynamic DNS |
| NIST CSF 2.0 | PR.AT-01, DE.CM-09, DE.AE-02 | Awareness, endpoint monitoring, alert analysis |
| MITRE D3FEND | D3-DNSDL DNS Denylisting, D3-EAL Executable Allowlisting | Blocking C2 and unwanted script execution |
Practitioner checklist
- Do not trust Colombian government sender domains by default; scan their mail as strictly as any other.
- Quarantine password-protected archives and script or shortcut attachments.
- Patch CVE-2024-43451 and block outbound SMB and WebDAV.
- Block dynamic DNS domains and alert on RAT-style ports such as 4050.
- Hunt for scheduled tasks masquerading as Google updaters.
- Put phishing-resistant MFA on public sector and finance mailboxes.
- After an infection, rotate banking and mail credentials and check for onward phishing.
- Detonate suspicious links from a regional egress point so geofenced payloads are seen.
Standards and references
- MITRE ATT&CK: APT-C-36 (G0099)
- MITRE ATT&CK: Compromise Accounts: Email Accounts
- CISA: Known Exploited Vulnerabilities Catalog
- Kaspersky Securelist: BlindEagle APT in Latin America
- Check Point Research: Blind Eagle: ...And Justice for All
- Recorded Future Insikt Group: TAG-144 report
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Threat Actor Groups Guide · Latin American Banking Trojans Guide · AsyncRAT, Remcos and njRAT Commodity RATs Guide · Steganography in Attacks Guide · Account Takeover Prevention Guide