BlindEagle Hackers Attacking Government Agencies with Powershell Scripts
In early September 2025, BlindEagle, a South American threat group, initiated an advanced cyberattack against Colombian government agencies, specifically targeting a department within the Ministry of Commerce, Industry, and Tourism (MCIT). The attack…
In early September 2025, BlindEagle, a South American threat group, initiated an advanced cyberattack against Colombian government agencies, specifically targeting a department within the Ministry of Commerce, Industry, and Tourism (MCIT). The attack utilized sophisticated phishing emails coupled with multi-stage malware deployment.
The attack began with phishing emails designed to impersonate the Colombian judicial system. These emails incorporated legal jargon and official formatting to create urgency, compelling recipients to acknowledge what appeared to be a labor lawsuit notification. The phishing emails were sent from compromised accounts within the same organization, enhancing the credibility of the messages and circumventing conventional email security measures.
Zscaler analysts identified the attack chain, noting the use of a complex, file-less strategy to evade detection. The initial attachment was an SVG image containing encoded HTML that redirected users to a fraudulent web portal resembling the legitimate Colombian judicial branch.
The attack utilized sophisticated phishing emails coupled with multi-stage malware deployment.
The infection mechanism demonstrated advanced techniques, including steganography and the use of legitimate services for payload delivery. JavaScript files within the attack chain employed intricate deobfuscation routines to convert integer arrays into executable code. Additionally, a PowerShell command downloaded an image file from the Internet Archive, extracting a Base64-encoded malicious payload and loading it directly into memory using .NET reflection.
This approach prevented any malicious file from being written to disk, significantly complicating detection by traditional file-based security solutions. The PowerShell script executed Caminho, a downloader malware with Portuguese artifacts, which subsequently retrieved DCRAT via Discord's content delivery network. DCRAT featured advanced evasion capabilities, including patching Microsoft's Antimalware Scan Interface (AMSI) to disable detection mechanisms.
The malware established persistence through scheduled tasks and registry modifications, granting attackers sustained access to compromised systems. This campaign illustrates BlindEagle's advancement in combining social engineering with technical proficiency in obfuscation, steganography, and legitimate service exploitation, posing a significant threat to government infrastructure with minimal detection risk.
Based on reporting by Cyber Security News.