Techjuice.Pk

Blind Eagle APT Targets Colombian Government with Multi-Stage Malware

First seen 19 Dec 2025, 20:00 UTC • •26.6

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The advanced persistent threat group Blind Eagle has executed a series of cyberattacks targeting Colombian government agencies using sophisticated multi-stage malware. The attacks began with spear-phishing emails that mimicked the judicial system, leading victims to download malicious scripts that enabled fileless execution of JavaScript. This campaign utilizes hacked internal email accounts to facilitate the intrusions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 183d ago How this analysis works

Threat Graph

17 entities, 45 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (4)

AguilaCiega
Apt-c-36
Blind Eagle
Tag-144

Technique (3)

Malware
Phishing
T1566 - Spearphishing Attachment

Organization (1)

Colombian Government

Malware (6)

AsyncRAT
Caminho
Dcrat
Njrat
Quasar
Remcos

Affected Platform (3)

Antimalware Scan Interface
Dynamic DNS
Windows

Relationships

AguilaCiega uses AsyncRAT
AguilaCiega uses Caminho
AguilaCiega uses Dcrat
AguilaCiega uses Njrat
AguilaCiega uses Quasar
Apt-c-36 uses AsyncRAT
Apt-c-36 uses Caminho
Apt-c-36 uses Dcrat
Apt-c-36 uses Njrat
Apt-c-36 uses Quasar
Blind Eagle uses AsyncRAT
Blind Eagle uses Caminho
Blind Eagle uses Dcrat
Blind Eagle uses Njrat
Blind Eagle uses Quasar
Tag-144 uses AsyncRAT
Tag-144 uses Caminho
Tag-144 uses Dcrat
Tag-144 uses Njrat
Tag-144 uses Quasar
AguilaCiega uses Malware
AguilaCiega uses Phishing
AguilaCiega uses T1566 - Spearphishing Attachment
Apt-c-36 uses Malware
Apt-c-36 uses Phishing
Apt-c-36 uses T1566 - Spearphishing Attachment
Blind Eagle uses Malware
Blind Eagle uses Phishing
Blind Eagle uses T1566 - Spearphishing Attachment
Tag-144 uses Malware
Tag-144 uses Phishing
Tag-144 uses T1566 - Spearphishing Attachment
AguilaCiega targets Colombian Government
Apt-c-36 targets Colombian Government
Blind Eagle targets Colombian Government
Tag-144 targets Colombian Government
AsyncRAT targets Colombian Government
Caminho targets Colombian Government
Dcrat targets Colombian Government
Njrat targets Colombian Government
Quasar targets Colombian Government
Remcos targets Colombian Government
AguilaCiega related to Antimalware Scan Interface
AguilaCiega related to Dynamic DNS
AguilaCiega related to Windows

Following this threat?

Track AguilaCiega, AsyncRAT and Colombian Government in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed