Blind Eagle Hackers Exploit Trust to Bypass Email Security Controls

BlindEagle threat actors are exploiting compromised internal email accounts to launch spear-phishing campaigns that bypass traditional email security controls, targeting Colombian government agencies with sophisticated multi-stage malware attacks, according to Zscaler ThreatLabz research.

The cybersecurity firm discovered the campaign in early September 2025, revealing that the South American threat group targeted a government agency under Colombia’s Ministry of Commerce, Industry and Tourism (MCIT) using a phishing email sent from what appears to be a compromised account within the same organization.

This technique exploits inherent trust between colleagues and leverages internal email infrastructure to evade detection.

Attack Chain Analysis

The attack begins with a phishing email sent to a shared IT team email address from another agency-shared account, making it appear legitimate.

BlindEagle’s campaign leverages in-memory scripts, legitimate internet services like Discord, steganography, and the deployment of Caminho and DCRAT.

Security analysis of the email metadata revealed that both sender and receiver domains had properly configured DMARC, DKIM, and SPF protocols with no evident flaws.

The email trajectory appeared completely legitimate, with all “Received” headers referencing Microsoft 365/Exchange servers, including the originating server.

Notably, DMARC, DKIM, and SPF checks were not applied because the message remained entirely within the organization’s Microsoft 365 tenant.

The phishing lure employed a legal-themed design mimicking Colombia’s judicial system, referencing an authentic-sounding labor lawsuit case number and date to pressure recipients into immediate action.

The email contained a clickable SVG image that, when activated, decoded a Base64-encoded HTML page mimicking an official Colombian judicial portal.

This fraudulent portal automatically downloaded a JavaScript file named “ESCRITO JUDICIAL AGRADECEMOS CONFIRMAR RECIBIDO NOTIFICACION DE ADMISION DEMANDA LABORAL ORDINARIA E S D.js” within seconds.

The attack chain initiates a file-less execution sequence comprising three JavaScript snippets followed by a PowerShell command.

The first two scripts deobfuscate embedded payloads using a simple algorithm that reconstructs executable code to launch the next stage.

The third JavaScript stage introduces Unicode-based comment obfuscation and employs Windows Management Instrumentation (WMI) to execute a PowerShell command through the Win32_Process.Create() method with hidden window properties.

After isolating and decoding the payload, the script dynamically loads it as a .NET assembly using reflection, culminating in the invocation of the VAI method within the ClassLibrary1 home class.

Caminho Downloader and DCRAT Payload

ThreatLabz identified the loaded assembly as Caminho (also known as VMDetectLoader), a malware downloader first traced to May 2025.

The PowerShell command downloads an image file from the Internet Archive, carving out a Base64-encoded payload embedded between “BaseStart-” and “-BaseEnd” markers.

The configuration is encrypted using AES-256 with a symmetric key, and includes a certificate serving dual purposes: ensuring configuration integrity and enabling C2 server authentication.

BlindEagle was among the early adopters, potentially using it in campaigns documented since June 2025. The malware’s codebase contains Portuguese-language argument names like “caminho” (meaning “path”), suggesting origins within the Brazilian cybercriminal ecosystem.

Caminho’s primary method downloads a text file named AGT27.txt from a Discord CDN URL, which is obfuscated through Base64 encoding and reversal.

The file never touches disk; instead, it loads directly into memory. Caminho then deobfuscates the Base64-encoded and reversed content, executing it via process hollowing where a legitimate MSBuild.exe instance is hollowed out to host the malicious code.

The injected payload is DCRAT, an open-source C# remote access trojan offering keylogging, disk access, and other capabilities.

DCRAT distinguishes itself from AsyncRAT variants by patching Microsoft’s Antimalware Scan Interface (AMSI) to evade detection.

ThreatLabz identified 24 hosts worldwide exposing certificates issued by the same source as the DCRAT sample, though only a subset likely belongs to the threat actor’s infrastructure.

The campaign is attributed to BlindEagle with medium confidence based on multiple factors. The DCRAT C2 domain consistently resolves to Swedish IP addresses under ASN 42708 (GleSYS AB), a hosting provider known to be utilized by BlindEagle.

The campaign also employs Dynamic DNS services from ydns[.]eu, previously documented as a BlindEagle preference.

Victimology strongly supports attribution, as Colombia remains BlindEagle’s primary target with documented history of attacking Colombian government entities.

Indicators Of Compromise (IOCs)

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.