An email about paying a supplier ended with an attacker holding full interactive control of a machine in Colombia. The country's national cyber emergency response team, COLCERT, has published a TLP:CLEAR alert saying forensic analysis confirmed a Remcos RAT infection, and links the activity to Blind Eagle, the espionage group also tracked as APT-C-36 and TAG-144. COLCERT assesses the risk level as HIGH.
Remcos is a commercial remote access tool sold openly and abused constantly, which is worth keeping in mind: because the tooling is commodity, tool overlap alone is weaker attribution evidence than bespoke malware would be. COLCERT frames Remcos as a trojan frequently employed by actors such as Blind Eagle, a group it describes as historically focused on Latin American organizations.
How the attack works
The initial vector was phishing built around a supplier payment lure, distributing VBS script files. From there the alert traces a deliberately long execution chain, VBS to BAT to EXE to VBS to JS, ending with the injection of a final payload named svchot.exe, a single character away from the legitimate Windows process svchost.exe and designed to pass for it.
The persistence choices are the tell. The operators registered a scheduled task disguised as a OneDrive service, and abused BITS, the built-in Windows background transfer service, through the bitsadmin command to pull down files covertly while imitating Microsoft Defender updates. Both techniques borrow the appearance of routine Microsoft maintenance, which is exactly what busy administrators skim past.
Command and control runs on three tiers, staging to relay to the Remcos controller, built on DuckDNS dynamic hostnames and funnelling traffic to a hosting provider in Romania (AS9009, M247).
What the attacker gets
COLCERT lists the capabilities it considers confirmed by the Remcos infection: complete interactive remote access to the compromised host, extraction of credentials stored in browsers, mail clients and local applications, keylogging, screen capture, interception of the webcam and microphone, exfiltration of sensitive files and documents, and remote execution of commands, scripts and additional malicious binaries. In practical terms the machine and everything reachable from it should be treated as compromised.
Who Blind Eagle is
Blind Eagle, also identified as APT-C-36, TAG-144, AguilaCiega and APT-Q-98, has documented activity going back to 2018. Its operations concentrate almost exclusively on Spanish-speaking organizations and individuals, and COLCERT calls it one of the groups with the greatest operational continuity and volume of targeted attacks against Colombia, with additional incursions recorded in Ecuador. That persistence, rather than technical sophistication, is what makes it a standing problem for Colombian defenders. It is not the only one: COLCERT also warned in July about a surge of Gentlemen ransomware claims against the country. Our Colombia profile tracks the wider picture.
What you should do
Treat unexpected payment and invoice emails as the highest risk category they are, especially where they carry script attachments. Block or heavily restrict VBS, JS and BAT execution for ordinary users through policy, since almost no business workflow needs them. Hunt for bitsadmin transfers that no administrator initiated, for scheduled tasks impersonating OneDrive or Defender, and for processes whose names are near misses for Windows binaries. On the network side, DuckDNS lookups from a corporate endpoint deserve scrutiny in their own right. The alert is published in Spanish at COLCERT's advisory page.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.