Blind Eagle, a threat actor also known as APT-C-36, has initiated a new cyberattack campaign targeting organizations across Latin America using judicial and administrative-themed phishing lures to distribute a remote access trojan, as first reported by The Hacker News.
The group, active since 2018, employs spear-phishing emails containing weaponized Scalable Vector Graphics files that impersonate official entities like the Office of the Attorney General in Colombia. These files utilize HTML smuggling to bypass security controls by assembling malicious ZIP archives directly within a web browser. Once executed, a JavaScript dropper masquerading as a network auditor performs system reconnaissance and bypasses the Windows Antimalware Scan Interface and Event Tracing for Windows. The attack sequence concludes by establishing persistence in the Windows Startup folder and deploying a custom remote access trojan that shares lineage with AsyncRAT and DCRat. By targeting judicial, fiscal and educational institutions, the attackers gain access to sensitive legal and financial data. Researchers note that the use of regional languages, Brazilian infrastructure and specific victimology confirms this operation is part of a Brazilian cluster associated with the APT-C-36 group. While no confirmed compromises have been documented, the potential impact includes data exfiltration, keystroke logging and unauthorized remote surveillance of affected systems.
Source: The Hacker News
