TAG-144: Actors Attacking Government Entities With New Tactics, Techniques, and Procedures

The threat actor TAG-144, also referred to as Blind Eagle or APT-C-36, has been linked to five distinct activity clusters operating from May 2024 through July 2025, with a focus on Colombian government entities at local, municipal, and federal levels. The group, active since at least 2018, uses a mix of cyber-espionage and financially motivated tactics, prioritising credential theft and surveillance via commodity remote access Trojans such as AsyncRAT, DcRAT, REMCOS RAT, XWorm, and LimeRAT.

Its clusters feature multi-stage infection chains that abuse legitimate internet services like Discord, GitHub and Archive[.]org for payload staging, with steganography embedded in image files to evade detection. Infrastructure analysis points to the heavy use of VPS, Colombian ISP IPs, dynamic DNS providers like duckdns[.]org and noip[.]com, and occasional VPNs such as TorGuard to obscure C2 activity.

The campaigns overlap across government, education, healthcare and energy sectors, and are linked to the broader South American focus, including overlaps with Red Akodon through shared repositories and compromised accounts used for spearphishing. Security teams are urged to block associated RAT C2s, deploy detection rules such as YARA, Sigma and Snort, and monitor LIS connections for anomalous activity.