Blind Eagle’s Five Clusters Target Colombia Using RATs, Phishing Lures, and Dynamic DNS Infra
Summary: Recorded Future's Insikt Group identified five distinct activity clusters tied to the threat actor Blind Eagle (tracked as TAG-144) between May 2024 and July 2025, primarily targeting Colombian government entities at local, municipal, and federal levels. The campaigns use spear-phishing lures impersonating local government agencies, URL shorteners, compromised email accounts, dynamic DNS services, and legitimate services such as Bitbucket, Discord, Dropbox, GitHub, and the Internet Archive to stage payloads including Lime RAT, DCRat, AsyncRAT, and Remcos RAT.
What you should know: Nearly 60% of the observed Blind Eagle activity in the analysis period targeted the government sector, and the group has sustained this focus on Colombia since at least 2018 - raising the question Recorded Future itself poses of whether this is purely financially driven or includes state-sponsored espionage.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026