Blind Eagle’s Five Clusters Target Colombia Using RATs, Phishing Lures, and Dynamic DNS Infra
Between May 2024 and July 2025, cybersecurity experts identified five different activity clusters associated with the persistent threat actor Blind Eagle.
The Recorded Future Insikt Group saw these attacks, which mostly targeted local, municipal, and federal government officials in Colombia. The activity is being monitored by the threat intelligence company under the TAG-144 label.
According to the Mastercard-owned company, the clusters differ greatly in infrastructure, malware deployment, and other operational methods, even though they use similar tactics, techniques, and procedures (TTPs), such as using legitimate internet services (LIS), dynamic domain providers, and open-source and cracked remote access trojans (RATs) for staging.
Since at least 2018, Blind Eagle has targeted...