Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
BlindEagle Targets Colombian Government Agency with Caminho and DCRAT
Malware Families
Excerpt
IntroductionIn early September 2025, Zscaler ThreatLabz discovered a new spear phishing campaign attributed to BlindEagle, a threat actor who operates in South America and targets users in Spanish-speaking countries, such as Colombia. In this campaign, BlindEagle targeted a government agency under the control of the Ministry of Commerce, Industry and Tourism (MCIT) in Colombia using a phishing email sent from what appears to be a compromised account within the same…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability(5)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | ydns.eu | High | Score 58/100 | First seen |
| SHA256 | 3ef2cf8f65a9a6f4955ecd0292af0cd68e65864907d07543c416ab28a2acfa6d | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…