Feeds.Feedburner

Blind Eagle Launches Phishing Campaign Targeting Latin American Organizations

First seen 11 Nov 2026, 04:11 UTC • •55.3

Article Content

1 / 7

Browse articles

ThreatCluster •November 11, 2026 at 04:12 UTC

•Blind Eagle targets Latin American organizations with judicial-themed phishing emails.
•The campaign uses weaponized SVG files to deliver a RAT related to AsyncRAT and DCRat.
•No confirmed compromises have been reported, but the potential impact is significant.

The threat actor Blind Eagle, also known as APT-C-36, has initiated a new phishing campaign targeting organizations in Latin America. The campaign employs judicial and administrative-themed phishing emails to distribute a remote access trojan (RAT) related to AsyncRAT and DCRat. Attackers use weaponized Scalable Vector Graphics (SVG) files that impersonate official entities, such as Colombia's Office of the Attorney General, to bypass security measures through HTML smuggling. Once executed, the malware conducts system reconnaissance and establishes persistence on the host system. The phishing emails are tailored in Portuguese and Spanish, indicating a focus on Spanish-speaking victims. Although no confirmed compromises have been reported, the potential impact includes unauthorized access to sensitive legal and financial data. The campaign highlights the ongoing threat posed by Blind Eagle, which has been active since 2018.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 2h ago How this analysis works

Timeline

2026-11-10

Blind Eagle phishing campaign reported

The Hacker News reported on Blind Eagle's new phishing campaign targeting Latin American organizations using judicial-themed lures.

The Hacker News

Threat Graph

16 entities, 28 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

Apt-c-36
Blind Eagle

Technique (8)

Malware
Phishing
T1059.001 - PowerShell
T1059 - Command and Scripting Interpreter
T1543.003 - Windows Service
T1547.001 - Registry Run Keys / Startup Folder
T1566.001 - Spearphishing Attachment
T1566 - Phishing

Campaign (1)

APT-C-36 Operation

Organization (1)

Office Of The Attorney General Of Colombia

Malware (2)

AsyncRAT
Dcrat

Affected Platform (1)

Windows

Tool (1)

PowerShell

Relationships

Apt-c-36 uses AsyncRAT
Apt-c-36 uses Dcrat
Blind Eagle uses AsyncRAT
Blind Eagle uses Dcrat
Apt-c-36 uses PowerShell
Blind Eagle uses PowerShell
Apt-c-36 uses Malware
Apt-c-36 uses Phishing
Apt-c-36 uses T1059.001 - PowerShell
Apt-c-36 uses T1059 - Command and Scripting Interpreter
Apt-c-36 uses T1543.003 - Windows Service
Blind Eagle uses Malware
Blind Eagle uses Phishing
Blind Eagle uses T1059.001 - PowerShell
Blind Eagle uses T1059 - Command and Scripting Interpreter
Blind Eagle uses T1543.003 - Windows Service
APT-C-36 Operation attributed to Apt-c-36
APT-C-36 Operation attributed to Blind Eagle
APT-C-36 Operation uses AsyncRAT
APT-C-36 Operation uses Dcrat
Apt-c-36 targets Office Of The Attorney General Of Colombia
Blind Eagle targets Office Of The Attorney General Of Colombia
AsyncRAT targets Office Of The Attorney General Of Colombia
Dcrat targets Office Of The Attorney General Of Colombia
Apt-c-36 related to T1547.001 - Registry Run Keys / Startup Folder
Apt-c-36 related to T1566.001 - Spearphishing Attachment
Apt-c-36 related to T1566 - Phishing
Apt-c-36 related to Windows

Following this threat?

Track Apt-c-36, AsyncRAT and Office Of The Attorney General Of Colombia in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed