TAG-144 Activity Analysis in South America

This technical report provides an analysis of TAG-144, also known as Blind Eagle, detailing its operational activities during 2024 and 2025, particularly its targeting of Colombian government entities. Insikt Group tracked five distinct clusters of activity associated with TAG-144, each exhibiting unique tactics, techniques, and procedures (TTPs). The report outlines the group's extensive infrastructure, including the use of virtual private servers and dynamic DNS services to conduct cyber operations. It describes the malware employed by TAG-144, notably various remote access trojans (RATs), and the multi-stage infection chains utilized to deploy these threats. The report emphasizes the necessity for security defenders to implement specific mitigation strategies against TAG-144’s activities, including blocking malicious IP addresses, monitoring for unusual network connections, and enhancing email filtering systems. Additionally, it notes the importance of continuous monitoring of the cybercriminal landscape for evolving threats, aiming to adapt defensive measures effectively against this persistent threat group.