Blind Eagle’s Five Clusters Target Colombia Using RATs, Phishing Lures, and Dynamic DNS Infra

Cybersecurity researchers have linked five distinct activity clusters to the threat actor known as Blind Eagle between May 2024 and July 2025, with attacks focused primarily on Colombia’s government sector alongside other regional targets, according to Recorded Future Insikt Group. The clusters share similar TTPs, including the use of open-source and cracked remote access Trojans, dynamic domain providers, and legitimate internet services for staging, though they differ in infrastructure and deployment.

Cluster 1 (February 2025 to July 2025) targeted Colombian government entities with DCRat, AsyncRAT, and Remcos RAT, while Cluster 2 (September 2024 to December 2024) hit government and education, defence, and retail sectors with AsyncRAT and XWorm; Cluster 3 (September 2024 to July 2025) deployed AsyncRAT and Remcos RAT; Cluster 4 (May 2024 to February 2025) tied to TAG-144’s

phishing infrastructure mimicking Banco Davivienda, Bancolombia and BBVA; and Cluster 5 (March to July 2025) used Lime RAT and a cracked AsyncRAT variant seen in the earlier clusters.

The group’s campaigns leverage spear-phishing with lures impersonating local government agencies, SVG attachments that fetch a JavaScript payload, and PowerShell to load RAT payloads, with C2 infrastructure incorporating Colombian ISP IPs, Proton666 VPS, and VPN services, alongside dynamic DNS services such as duckdns[.]org, ip-ddns[.]com, and noip[.]com.

Recorded Future notes that nearly 60% of observed Blind Eagle activity targeted government entities, though the campaigns also touched education, healthcare, retail, transportation, defence and oil sectors across Colombia, Ecuador, Chile and Panama, raising questions about whether the group pursues state-sponsored espionage alongside financially driven operations.