Blind Eagle: …And Justice for All

Check Point Research attributes coordinated campaigns (Nov 2024–Feb 2025) against Colombian government and private organizations to APT-C-36 (Blind Eagle), which used crafted .url files that trigger UNC/WebDAV requests to notify attackers and download a HeartCrypt-packed .NET loader that fetches and executes Remcos RAT; the group abused Google Drive, Bitbucket and GitHub for payload hosting, rotated C2s frequently, achieved high infection counts (1,600+ in one campaign; ~9,000 across related campaigns), and exposed a prior phishing dataset of >8,000 PII entries (OPFail).