Blind Eagle Hacks Colombian Institutions Using NTLM Flaw, RATs and GitHub
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-43451 | NTLMv2 Hash Disclosure Spoofing Vulnerability in Microsoft Windows CVE-2024-43451 is a flaw in the NTLM authentication implementation of Microsoft Windows that lets an attacker obtain a user's NTLMv2 authentication hash. It requires user interaction: a victim who engages with attacker-supplied content, such as a crafted file or an attacker-controlled file path/URL reference (consistent with the CWE-73 external control of file name weakness), causes Windows to silently initiate an NTLM authentication to a hostile host, leaking the hash. An attacker who captures the hash can crack it offline to recover the user's password or relay it to authenticate (spoof) as that user to other services, enabling credential theft and lateral movement. Any unpatched installation of the listed Windows 10, Windows 11, and Windows Server 2008/2012/2016/2019 versions is exposed, which covers essentially every mainstream Windows estate current in late 2024. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-12, researchers have reported Russian-linked attackers using it in phishing campaigns delivering RAT malware, and EPSS assigns an 84.1% probability of exploitation within 30 days, though no public proof-of-concept code is known. Do: Apply Microsoft's November 2024 Patch Tuesday security updates (or later cumulative updates) to all listed Windows 10/11 client and Windows Server versions; the KEV listing makes patching mandatory for US federal agencies. As interim mitigation, block outbound SMB/HTTP NTLM authentication to untrusted destinations (e.g., firewall outbound TCP 445 from endpoints) and, where feasible, restrict NTLM in favor of Kerberos via Group Policy. Hunt for phishing emails containing crafted files and for unexpected outbound authentication attempts from workstations, and rotate credentials for accounts that may have authenticated to untrusted hosts before patching. | 6.5 | 84% | KEV |
| masshundreds of millions of Windows 10/11 endpoints and Windows Server 2008-2019 instances worldwide |
Full article598 words · extracted from thehackernews.com · click to collapse
The threat actor known as Blind Eagle has been linked to a series of ongoing campaigns targeting Colombian institutions and government entities since November 2024.
"The monitored campaigns targeted Colombian judicial institutions and other government or private organizations, with high infection rates," Check Point said in a new analysis.
"More than 1,600 victims were affected during one of these campaigns which took place around December 19, 2024. This infection rate is significant considering Blind Eagle's targeted APT approach."
Blind Eagle, active since at least 2018, is also tracked as AguilaCiega, APT-C-36, and APT-Q-98. It's known for its hyper-specific targeting of entities in South America, specifically Colombia and Ecuador.
Attack chains orchestrated by the threat actor entail the use of social engineering tactics, often in the form of spear-phishing emails, to gain initial access to target systems and ultimately drop readily available remote access trojans like AsyncRAT, NjRAT, Quasar RAT, and Remcos RAT.
The latest set of intrusions are notable for three reasons: The use of a variant of an exploit for a now-patched Microsoft Windows flaw (CVE-2024-43451), the adoption of a nascent packer-as-a-service (PaaS) called HeartCrypt, and the distribution of payloads via Bitbucket and GitHub, going beyond Google Drive and Dropbox.
Specifically, HeartCrypt is used to protect the malicious executable, a variant of PureCrypter that's then responsible for launching the Remcos RAT malware hosted on a now-removed Bitbucket or GitHub repository.
CVE-2024-43451 refers to an NTLMv2 hash disclosure vulnerability that was fixed by Microsoft in November 2024. Blind Eagle, per Check Point, incorporated a variant of this exploit into its attack arsenal a mere six days after the release of the patch, causing unsuspecting victims to advance the infection when a malicious .URL distributed via a phishing email is manually clicked.
"While this variant does not actually expose the NTLMv2 hash, it notifies the threat actors that the file was downloaded by the same unusual user-file interactions," the cybersecurity company said.
"On devices vulnerable to CVE-2024-43451, a WebDAV request is triggered even before the user manually interacts with the file with the same unusual behavior. Meanwhile, on both patched and unpatched systems, manually clicking the malicious .URL file initiates the download and execution of the next-stage payload."
Check Point pointed out that the "rapid response" serves to highlight the group's technical expertise and its ability to adapt and pursue new attack methods in the face of evolving security defenses.
Serving as a smoking gun for the threat actor's origins is the GitHub repository, which has revealed that the threat actor operates in the UTC-5 timezone, aligning with several South American countries.
That's not all. In what appears to be an operational error, an analysis of the repository commit history has uncovered a file containing account-password pairs with 1,634 unique email addresses.
While the HTML file, named "Ver Datos del Formulario.html," was deleted from the repository on February 25, 2025, it has been found to contain details such as usernames, passwords, email, email passwords, and ATM PINs associated with individuals, government agencies, educational institutions, and businesses operating in Colombia.
"A key factor in its success is its ability to exploit legitimate file-sharing platforms, including Google Drive, Dropbox, Bitbucket, and GitHub, allowing it to bypass traditional security measures and distribute malware stealthily," Check Point said.
"Additionally, its use of underground crimeware tools such as Remcos RAT, HeartCrypt, and PureCrypter reinforces its deep ties to the cybercriminal ecosystem, granting access to sophisticated evasion techniques and persistent access methods."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/blind-eagle-hacks-colombian.html