A Persistent Threat: Blind Eagle Hacking Group Continues to Target Colombia

According to Insikt Group, TAG-144, also known as Blind Eagle, AguilaCiega, APT-C-36, or APT-Q-98, has five distinct activity clusters that have operated at various times across 2024 and 2025, continuing to target Colombian government institutions at local, municipal and federal levels as well as private and NGO entities.

The report notes that the threat group leverages a broad toolset, including AsyncRAT, REMCOS RAT, LimeRAT, DcRAT, njRAT and Quasar variants like BlotchyQuasar, alongside dynamic DNS services and legitimate internet services for staging and delivery. Initial access is most commonly achieved via spearphishing emails impersonating Colombian authorities, using shortened URLs and geo-fencing to confine malicious payloads to Colombian or Ecuadorian IP ranges.

The infection chain typically includes obfuscated PowerShell or JavaScript, staging on LIS or free hosting platforms, and deployment of RATs that enable remote control, credential theft, keylogging and surveillance. The group has been observed targeting government entities and financial, energy, education, healthcare, manufacturing and retail sector organisations, with occasional activity in Ecuador, Chile, Panama and Spanish-speaking North America. The analysis also highlights overlaps with Red Akodon and shared tooling and infrastructure across clusters.