APT-C-36 Updates Its Long-term Spam Campaign Against South American Entities With Commodity RATs

APT-C-36 (aka Blind Eagle) is running a targeted spear-phishing campaign against Colombian and other South American organizations using spoofed DIAN and social-engineering lures that deliver password-protected archives via geo-targeted URL shorteners; the payload is BitRAT (a remote access trojan) with a Camellia-encrypted configuration and custom key derivation, impacting government, financial, healthcare and other sectors and likely motivated by financial gain.