TAG-144’s Persistent Grip on South American Organizations

Insikt Group attributes a multi-cluster campaign to TAG-144 (Blind Eagle) active across 2024–2025 that targeted predominantly Colombian government organizations using spearphishing lures (including legitimate compromised government email accounts), multiple open-source/cracked RATs (AsyncRAT, REMCOS, DcRAT, LimeRAT, XWorm, etc.), and staging via legitimate internet services and steganography; the report catalogs five distinct infrastructure clusters, extensive IoCs (IPs, domains, file hashes), victim timelines, overlaps with a group dubbed Red Akodon, and provides practical mitigations and detection rules.