MalwarePublished 26 Aug 2025Updated 25 Sep 2025

TAG-144's Persistent Grip on South American Organizations

Source AlienVault OTX General

Description

Insikt Group has identified five distinct activity clusters linked to TAG-144 (Blind Eagle), targeting primarily Colombian government entities across local, municipal, and federal levels throughout 2024 and 2025. The clusters share similar tactics, techniques, and procedures (TTPs) such as using open-source and cracked remote access trojans (RATs), dynamic domain providers, and legitimate internet services (LIS) for staging. However, they differ in infrastructure, malware deployment, and operational methods. The group maintains an extensive operational infrastructure, employs various RATs, and uses multi-stage infection chains. TAG-144's primary focus appears to be credential theft and espionage, with evidence linking it to Red Akodon and compromised Colombian government email accounts used in spearphishing campaigns.

Impact

For European organizations, the direct impact of TAG-144 is currently limited given the group's focus on South American targets, particularly Colombian government entities. However, the use of common RATs and spearphishing tactics means that European organizations could be at risk if the group expands its targeting or if similar TTPs are adopted by other threat actors. Credential theft and espionage pose significant risks to confidentiality and integrity of sensitive information, potentially leading to unauthorized access, data breaches, and long-term compromise of critical systems. Government agencies, critical infrastructure, and organizations involved in international cooperation with South American entities could be indirectly affected. The use of legitimate internet services and dynamic domains for staging complicates detection and response efforts, increasing the potential dwell time of attackers within networks. Additionally, the multi-stage infection chains and diverse malware deployment methods increase the difficulty of mitigation and forensic analysis. Overall, while the immediate threat to Europe is moderate, vigilance is warranted due to the adaptable nature of TAG-144 and the potential for their tactics to be adopted or repurposed by other actors targeting European entities.

Defensive guidance

European organizations should implement targeted defenses against RAT-based intrusions and spearphishing campaigns. Specific recommendations include: 1) Enhance email security by deploying advanced anti-phishing solutions that analyze sender reputation, email content, and attachment behavior to detect spearphishing attempts, especially those mimicking government or trusted entities. 2) Monitor and restrict the use of dynamic domain providers and suspicious legitimate internet services within network traffic to identify potential staging infrastructure. 3) Employ endpoint detection and response (EDR) solutions capable of detecting behaviors associated with known RATs such as LimeRAT, DCrat, AsyncRAT, and others, focusing on multi-stage infection patterns and unusual remote access activities. 4) Conduct regular credential audits and enforce multi-factor authentication (MFA) across all critical systems to reduce the impact of credential theft. 5) Implement network segmentation to limit lateral movement in case of compromise. 6) Provide targeted user awareness training focused on spearphishing risks and indicators of compromise related to government-themed phishing. 7) Establish threat intelligence sharing with regional and international partners to stay informed about evolving TTPs related to TAG-144 and similar groups. 8) Regularly review and update incident response plans to address multi-stage infections and advanced persistent threat (APT) scenarios.

Indicators of compromise

Domains 262

acortaurl.com
ordedfuture.com
sxyebfiv.sv
hujmb.gov.co
simacota-santander.gov.co
cendoj.ramajudicial.gov.co
magdalena.gov.co
0242024infinito.duckdns.org
2seguro2025.duckdns.org
aets.duckdns.org

IP addresses 60

138.0.90.150
143.137.98.182
143.137.99.214
152.200.146.245
152.203.33.47
152.231.30.83
161.10.134.110
170.239.205.17
177.253.232.42
177.255.84.173

Hashes 482

d686fcf8e50c5703092b699851f79406
f180180f74a070444ce2c1ee425e5eb9
89ee67b66008297107f76b7e778d4db1a475d6af
e515f1c402b59db815ffd18d66620eb4802f8491
2a2e92fc86be8adf429e4172368dfacd3fd0c157d0f602d713acf82c89932edf
c671155c2ff3529435a4facaabd8a06c6f5e559ff24763d6f387bc818c453727
96e79e988de336208f758e65835974c5
9158861b439e1cd6db50200306b49b795fa28213
8f972b2fba44198800333d8f7d9b9b1daac3c0d4693481ca8ac8f6cab4af989f
018ed5e21ac44a7bed37d0f30ab22bbd

Community reviews

Loading reviews…