MalwarePublished 17 Dec 2025Updated 16 Jan 2026

BlindEagle Targets Colombian Government Agency with Caminho and DCRAT

Source AlienVault OTX General

Description

A spear phishing campaign targeting a Colombian government agency under the Ministry of Commerce, Industry and Tourism was discovered in September 2025. The attack, attributed to BlindEagle, utilized a compromised email account within the organization to bypass security controls. The campaign employed a sophisticated multi-layer attack chain, including a fake web portal, nested JavaScript and PowerShell scripts, steganography, and the deployment of Caminho as a downloader for DCRAT. The attack leveraged legal-themed lures, in-memory execution, and abuse of legitimate services like Discord. BlindEagle's evolution in tactics and use of new tools like Caminho demonstrates their ongoing threat to Colombian institutions.

Impact

For European organizations, the direct impact may be limited due to the specific targeting of Colombian government entities. However, the tactics and tools used by BlindEagle could be adapted or repurposed against European government agencies or critical infrastructure with similar IT environments. The use of compromised internal accounts to bypass security controls and the abuse of legitimate services like Discord for command and control pose risks to confidentiality, enabling data theft or espionage. The in-memory execution and steganography techniques complicate detection and response, potentially allowing prolonged undetected access. European organizations involved in diplomatic, trade, or governmental relations with Colombia or Latin America could face indirect risks if the threat actor expands targeting. Additionally, the campaign underscores the importance of securing email systems, monitoring for insider threats, and controlling the use of non-traditional communication platforms within sensitive networks. The medium severity rating reflects moderate ease of exploitation but significant potential damage if successful.

Defensive guidance

1. Implement advanced email security solutions with anomaly detection to identify compromised internal accounts and spear phishing attempts, including monitoring for unusual sending patterns and content. 2. Enforce strict multi-factor authentication (MFA) on all email and critical system accounts to reduce the risk of account compromise. 3. Deploy endpoint detection and response (EDR) tools capable of detecting in-memory execution, nested scripting, and steganographic payloads. 4. Restrict or monitor the use of unauthorized communication platforms such as Discord within corporate and government networks, especially for sensitive or classified environments. 5. Conduct regular user awareness training focused on spear phishing and social engineering, emphasizing the risks of legal-themed lures and suspicious web portals. 6. Utilize network segmentation and least privilege principles to limit lateral movement and access to critical systems. 7. Monitor scheduled tasks, WMI activity, and PowerShell execution logs for suspicious behavior indicative of attacker persistence or execution techniques. 8. Establish incident response playbooks tailored to multi-stage, stealthy intrusions involving advanced malware and legitimate service abuse. 9. Collaborate with threat intelligence providers to stay updated on BlindEagle tactics and indicators of compromise (IOCs). 10. Conduct regular security audits and penetration testing to identify and remediate gaps that could be exploited by similar threat actors.

Indicators of compromise

Domains 1

startmenuexperiencehost.ydns.eu

IP addresses 16

181.206.158.190
74.124.24.240
103.20.102.151
103.236.70.158
191.93.118.254
103.186.108.212
103.20.102.130
178.16.54.45
179.13.11.235
179.13.4.196

Hashes 22

4284e99939cebf40b8699bed31c82fd6
961ebce4327b18b39630bfc4edb7ca34
9799484e3942a6692be69aec1093cb6c
97adb364d695588221d0647676b8e565
bbb99dfd9bf3a2638e2e9d13693c731c
c98eb5fcddf0763c7676c99c285f6e80
d80237d48e1bbc2fdda741cbf006851a
21e95fed5fc5c4a10fafbc3882768cce1f6cd7af
38b0e360d58d4ddb17c0a2c4d97909be43a3adc0
3983a5b4839598ba494995212544da05087b811b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Dec 2025, 11:51 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 1

IP addresses 16

Hashes 22

Community reviews

Related threats