CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Blind Eagle's Five Activity Clusters Target Colombian Government and Other Sectors

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

Five distinct activity clusters linked to the Blind Eagle threat actor have been observed targeting Colombian government entities and other sectors between May 2024 and July 2025. The attacks primarily focus on local, municipal, and federal government levels, with a mix of cyber espionage and financially driven motivations. The campaigns employ a variety of remote access trojans (RATs), phishing lures, and dynamic DNS infrastructure. The operations span multiple sectors, including financial, petroleum, energy, education, healthcare, manufacturing, and professional services. The attacks involve spear-phishing lures impersonating local government agencies and use compromised email accounts to send malicious messages. The group leverages legitimate internet services for staging payloads to evade detection. The campaigns have used Visual Basic Script files as droppers to execute PowerShell scripts that download various RATs, including Lime RAT, DCRat, AsyncRAT, and Remcos RAT.

Timeline

  1. 27.08.2025 12:28 📰 1 articles

    Five Blind Eagle Activity Clusters Target Colombian Government and Other Sectors

    Between May 2024 and July 2025, five distinct activity clusters linked to the Blind Eagle threat actor were observed. These clusters targeted Colombian government entities and other sectors, employing a variety of RATs, phishing lures, and dynamic DNS infrastructure. The campaigns used spear-phishing lures impersonating local government agencies and compromised email accounts to send malicious messages. The group leveraged legitimate internet services for staging payloads to evade detection. Recent campaigns employed Visual Basic Script files as droppers to execute PowerShell scripts that downloaded various RATs, including Lime RAT, DCRat, AsyncRAT, and Remcos RAT.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

APT41 Targets U.S. Trade Officials in Cyber Espionage Campaign

The House Select Committee on China has issued a warning about ongoing cyber espionage campaigns by China-linked APT41 targeting U.S. trade officials and related organizations. The attacks involve phishing emails impersonating U.S. officials to steal sensitive information. The campaign coincides with contentious U.S.-China trade negotiations. The threat actors exploit software and cloud services to cover their tracks. The attacks aim to steal valuable data and gain unauthorized access to systems. The committee has noted similar tactics used in previous campaigns, including a January 2025 spear-phishing attempt targeting committee staffers. The FBI is investigating the ongoing cyber espionage campaign. APT41 has been known to conduct financially motivated activities in addition to state-sponsored espionage. The group has targeted various sectors, including logistics, utilities, healthcare, high-tech, and telecommunications. The committee recommends user awareness phishing training, mandatory multifactor authentication, FIDO keys, and appropriate email gateway and endpoint security tools to mitigate such attacks.

Open in new tab

U.S. sanctions Southeast Asian cyber scam operations targeting Americans

The U.S. Department of the Treasury has sanctioned multiple cyber scam operations in Southeast Asia, primarily in Burma and Cambodia, which collectively stole over $10 billion from Americans in 2024. These operations use forced labor, human trafficking, and violence, operating as modern slavery farms. The scams involve romance baiting and fake cryptocurrency investments. The financial damage increased by 66% compared to 2023. The sanctions target 19 entities and individuals, including those linked to the Karen National Army (KNA) in Burma and various organized crime networks in Cambodia. The sanctions block these entities from the U.S. financial system and limit their access to international financial services. The cybercriminal syndicates in Southeast Asia are estimated to net nearly $40 billion annually in illicit profits. In May, OFAC targeted Funnull Technology Inc. and its administrator Liu Lizhi for their part in romance scams that caused more than $200 million in losses. In July, Cambodian law enforcement raided several cyber-scam centers, arresting more than 1,000 people, the majority of whom were foreign nationals. The UNODC reported that the cybercriminal operations in the region netted $40 billion in 2024, a significant fraction of the GDPs of many nations in the region. Interpol reported arrests of more than 1,200 cyber- and financial criminals in Africa, many of whom were foreign nationals from Southeast Asia conducting similar operations.

Open in new tab

Axios Abuse and Salty 2FA Kits in Microsoft 365 Phishing Campaigns

Threat actors are leveraging HTTP client tools like Axios and Microsoft's Direct Send feature to execute advanced phishing campaigns targeting Microsoft 365 environments. These campaigns have demonstrated a 70% success rate, bypassing traditional security defenses and exploiting authentication workflows. The attacks began in July 2025 and have targeted executives and managers in various sectors, including finance, healthcare, and manufacturing. The phishing campaigns use compensation-themed lures to trick recipients into opening malicious PDFs containing QR codes that direct users to fake login pages. Additionally, a phishing-as-a-service (PhaaS) offering called Salty 2FA is being used to steal Microsoft login credentials and bypass multi-factor authentication (MFA). The Salty2FA kit includes advanced features such as subdomain rotation, dynamic corporate branding, and sophisticated evasion tactics to enhance its effectiveness and evade detection. Salty2FA activity began gaining momentum in June 2025, with early traces possibly dating back to March–April 2025. The campaigns have been active since late July 2025 and continue to this day, generating dozens of fresh analysis sessions daily. Salty2FA targets industries including finance, energy, telecom, healthcare, government, logistics, IT consulting, education, construction, chemicals, industrial manufacturing, real estate, consulting, metallurgy, and more.

Open in new tab

Kazakhstan's KazMunayGas Phishing Test Mistaken for Noisy Bear Campaign

Kazakhstan's state-owned oil and gas company KazMunayGas conducted a phishing test in May 2025, which was initially misinterpreted as a cyber espionage campaign by a new threat group named Noisy Bear. The test involved phishing emails targeting KazMunayGas employees with fake documents related to internal communications and policy updates. The phishing emails were sent from a compromised internal email address and included a ZIP attachment with a Windows shortcut (LNK) downloader, a decoy document, and a README.txt file with instructions. The campaign was designed to mimic official internal communications and included themes such as policy updates, internal certification procedures, and salary adjustments. The phishing test was conducted to train employees on identifying and responding to phishing attempts. However, it was mistakenly reported as a cyber espionage campaign by Seqrite Labs, which attributed the activity to a new threat group tracked as Noisy Bear. The threat actor was believed to be of Russian origin and had been active since at least April 2025. The misinterpretation led to speculation about the involvement of a new threat group and the use of sophisticated malware, including a PowerShell loader dubbed DOWNSHELL and a DLL-based implant. The threat actor used a compromised email address belonging to a KazMunayGas finance department employee to send phishing emails. The phishing emails impersonated mundane company business, including reviewing work schedules, incentive systems, and wages. The phishing emails contained a ZIP file with a decoy document and a shortcut (LNK) file named "Salary Schedule.lnk." The LNK file downloaded a batch script, which retrieved the attackers' PowerShell loader named DownShell. DownShell consists of two scripts: one for anti-analysis by undermining the Windows Antimalware Scan Interface (AMSI), and another for CreateRemoteThread Injection to establish a reverse shell. Noisy Bear used a sanctioned Russian bulletproof hosting provider, Aeza Group, to maintain its infrastructure. The threat activity carries geopolitical implications, targeting Kazakhstan's largest oil and gas company, which is state-owned and a significant economic entity. Seqrite Labs found infrastructure and tooling overlaps across other Central Asian attacks, indicating a broader campaign. The incident highlights the importance of clear communication and coordination between cybersecurity researchers and organizations to avoid misinterpretations and ensure accurate reporting of cyber threats.

Open in new tab

TAG-150 Expands Operations with CastleRAT in Python and C

The threat actor TAG-150, known for CastleLoader malware, has developed a new remote access trojan named CastleRAT. CastleRAT is available in both Python and C variants, and it is used to collect system information, execute commands, and download additional payloads. CastleRAT's development began in March 2025, and it is part of a multi-tiered infrastructure used by TAG-150. The malware is distributed through phishing attacks, fraudulent GitHub repositories, and other methods. The Python variant, also known as PyNightshade, and the C variant have different capabilities. The C variant includes keylogging, screenshot capture, file upload/download, and cryptocurrency clipper functionality. CastleRAT uses Steam Community profiles as dead drop resolvers for command-and-control (C2) servers. TAG-150 has been active since at least March 2025, using CastleLoader as an initial access vector for various secondary payloads, including remote access trojans, information stealers, and other loaders. TAG-150's operations have targeted critical infrastructure, including U.S. government agencies, and have been linked to a Play Ransomware attack against a French organization. The group's MaaS operation is likely promoted within closed circles, indicating a sophisticated and connected user base. TAG-150 is likely to develop and release additional malware in the near term and expand its distribution efforts.

Open in new tab