Blind Eagle Hackers Return with Refined Tools and Sophisticated Infection Chain

Jan 05, 2023Ravie LakshmananCyber Attack / Malware

A financially motivated threat actor tracked as Blind
Eagle has resurfaced with a refined toolset and an
elaborate infection chain as part of its attacks targeting
organizations in Colombia and Ecuador.

Check Point’s latest research^[1]
offers new insights into the Spanish-speaking group’s tactics and
techniques, including the use of sophisticated tools and
government-themed lures to activate the killchain.

Also tracked under the name APT-C-36, Blind Eagle is notable for
its narrow geographical focus and launching indiscriminate attacks
against South American nations since at least 2018.

Blind Eagle’s operations have been documented^[2]
by Trend Micro in September 2021, uncovering a spear-phishing
campaign primarily aimed at Colombian entities designed to deliver
a commodity malware known as BitRAT^[3], with a lesser focus
towards targets in Ecuador, Spain, and Panama.

Attacks chains commence with phishing emails containing a
booby-trapped link that, when clicked, leads to the deployment of
an open source trojan named Quasar RAT with the ultimate goal of
gaining access to the victim’s bank accounts.

Some of targeted banks consists of Banco AV Villas, Banco Caja
Social, Banco de Bogotá, Banco Popular, Bancoomeva, BBVA,
Colpatria, Davivienda, and TransUnion.

Should the email recipient be located outside of Colombia, the
attack sequence is aborted and the victim is redirected to the
official website of the Colombian border control agency, Migración
Colombia.

A related campaign singling out both Colombia and Ecuador
masquerades as the latter’s Internal Revenue Service (SRI) and
makes use of a similar geo-blocking technology to filter out
requests originating from other countries.

This attack, rather than dropping a RAT malware, employs a more
complex multi-stage process that abuses the legitimate mshta.exe binary^[4]
to execute VBScript embedded inside an HTML file to ultimately
download two Python scripts.

The first of the two, ByAV2.py, is an in-memory loader
engineered to run a Meterpreter payload^[5]
in DLL format. mp.py is also a Meterpreter artifact, only it’s
programmed in Python, indicating that the threat actor could be
using one of them as a redundant method to retain backdoor access
to the host.

“Blind Eagle is a strange bird among APT groups,” the
researchers concluded. “Judging by its toolset and usual
operations, it is clearly more interested in cybercrime and
monetary gain than in espionage.”

The development comes days after Qualys disclosed^[6]
that an unknown adversary is leveraging personal information stolen
from a Colombian cooperative bank to craft phishing emails that
result in the deployment of BitRAT.