APT-C-36__2021__APT-C-36_Updates_Its_Long-term_Spam_Campaign_Against_South_American_Entities_With_Commodity_RATs.pdf

APT-C-36 (aka Blind Eagle) is conducting targeted spam campaigns against South American organizations using phishing lures (impersonating DIAN or fake personal messages) that lead to geo-filtered shortened links, password-protected archives, and commodity RAT payloads (notably BitRAT). The report includes delivery and lure examples, infrastructure and IOC notes, a technical analysis of BitRAT's encrypted configuration (Camellia cipher and key derivation), observed targets across government, finance, healthcare and energy sectors, and mitigation recommendations.