Rewterz Threat Alert – Blind Eagle APT aka APT-C-36 – Active IOCs

Severity

High

Analysis Summary

BlindEagle is an Advanced Persistent Threat (APT) group that has been active since at least 2018 and is believed to be operating out of South America. The group is known for its targeted attacks on financial institutions and other organizations in the region and has used a variety of tools and techniques to achieve its objectives. The gang launched continual targeted attacks against Colombian government institutions as well as major firms in the financial sector, the petroleum industry, professional manufacturing, and so on. As with many APT groups, the full scope of BlindEagle’s capabilities and goals is not entirely clear, but it is considered to be a significant threat to organizations in the region.

BlindEagle is known to use custom malware, including QuasarRAT, as a key component of its attacks. QuasarRAT is a remote access Trojan (RAT) that allows the group to take full control of compromised systems and steal sensitive information. The group has also been observed using various other malware, including backdoors and keyloggers, to infiltrate and exfiltrate data from targeted systems.

In terms of its objectives, BlindEagle is primarily focused on stealing sensitive financial information from targeted organizations. The group has been observed stealing online banking credentials, credit card numbers, and other financial data. It is also believed to be working to gain access to sensitive government information and to compromise critical infrastructure in the region.

This APT group is considered to be a significant threat to organizations in South America, particularly those in the financial sector. To defend against BlindEagle, organizations should implement strong security measures, including firewalls, antivirus software, and intrusion detection systems, and educate their employees on best practices for avoiding phishing scams and other social engineering tactics.

In a recent campaign, the group was found targeting South American bank account by QuasarRAT.

Impact

• Information Theft and Espionage
• Financial Theft

Indicators of Compromise

Domain Name

• laminascol.linkpc.net
• upxsystems.com

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.