“Caminho” to Compromise: BlindEagle Hackers Hijack Government Emails in Colombia

According to Zscaler ThreatLabz, BlindEagle (also tracked as APT-C-36) struck a government agency under the Ministry of Commerce, Industry and Tourism in early September 2025, marking a shift in tactics for the group. The campaign used compromised internal email accounts to bypass security filters and deployed a new malware strain called Caminho, a downloader likely sold in underground marketplaces.

Unlike typical phishing from external domains, the operation began with a phishing email sent from within the target organisation’s own Microsoft 365 tenant, to abuse trust and bypass controls. The email masqueraded as an official notification from the Colombian Judicial Branch and directed recipients to a fraudulent web portal, where a receipt download triggered a three-stage infection sequence via JavaScript code snippets and a PowerShell command.

Steganography was employed to conceal the final payload, with a malicious PowerShell script hidden inside an image retrieved from the Internet Archive. Caminho then served as a bridge to fetch the final payload—DCRAT—from a hosted file on Discord, indicating a more modular, multi-layer attack chain.