Blind Eagle's late-October phishing wave counted 3,300 emails

Zenox counted nearly 3,300 malicious emails between late October and early November 2026 in a phishing wave it attributes to Blind Eagle, the Spanish-speaking group also tracked as APT-C-36 and active since 2018. The lures read as court notifications, fiscalía notices, tutela proceedings, and administrative documents in Portuguese and Spanish, aimed at the people whose jobs involve opening exactly those files: staff who handle cases, contracts, judicial matters, or institutional service requests.

Blind Eagle’s history is commodity RATs delivered by spear-phishing: AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT. The payload here is an AsyncRAT fork that Zenox ties to DCRat lineage by code structure, configuration, build characteristics, and observed behavior.

The delivery chain

One sample arrives as a Colombian judicial-themed XHTML attachment. The file is a weaponized SVG that renders a fake web page impersonating Colombia’s Fiscalía General de la Nación, the Office of the Attorney General. That page runs HTML smuggling: it assembles the next-stage ZIP archive locally in the browser using ZipCrypto, so the archive never crosses the mail gateway and email security controls never inspect it.

Inside the ZIP is a JavaScript dropper posing as Network Configuration Auditor version 2.7.298. It fingerprints the host first (system version, network profile, installation date, memory size, computer name, environment variables, and directory names localized in Portuguese and Spanish), then launches a Visual Basic Script that bypasses AMSI and ETW while displaying a fake criminal-citation page to hold the victim’s attention.

In parallel, the malware deletes the original XHTML artifact, clears Mark of the Web metadata so the downstream files are not flagged as internet-sourced, and writes persistence into the Windows Startup folder for execution on boot. PowerShell decodes and launches the final RAT in memory.

Attribution and targeting

Zenox reads the combination of Portuguese and Spanish lures, Brazilian infrastructure, operational timezone, and regional victimology as an APT-C-36 operation run through a Brazilian operational cluster. It could not confirm whether any of the emails produced a real compromise.

The targets are judicial, fiscal, administrative, and educational organizations, which gives the operator access to legal, financial, and institutional information when the chain works. Colombia remains a priority target. Zenox researcher Gabriel Alves attributes the repeated focus to structural vulnerabilities and uneven security maturity across parts of the country’s critical, public, financial, and private-sector infrastructure, together with regional actors’ familiarity with the Colombian context.

What to watch for

The useful detail for defenders is in the mechanics rather than the lure theme. HTML smuggling with ZipCrypto means the malicious archive is built client-side, so a mail filter never sees it; detection has to sit on the endpoint and in the browser. SVG and XHTML attachments that render full interactive pages are better treated as executable content than as images. The Mark of the Web stripping and Startup-folder persistence are both observable on the host. A file calling itself Network Configuration Auditor 2.7.298 that spawns VBScript and then PowerShell is a process lineage worth alerting on, whatever the email around it claimed to be.