Blind Eagle Exploits Proton66 Hosting for Phishing and RAT Deployment Against Colombian Banks

TL;DR

The threat actor Blind Eagle has been linked to the use of the Russian bulletproof hosting service Proton66 for phishing attacks and deploying Remote Access Trojans (RATs) against Colombian banks. Trustwave SpiderLabs identified this connection through digital assets related to Proton66, revealing an active threat cluster utilizing Visual Basic Script (VBS) files.

Blind Eagle’s Use of Proton66 Hosting for Cyber Attacks

The threat actor known as Blind Eagle has been attributed with high confidence to the use of the Russian bulletproof hosting service Proton66. Trustwave SpiderLabs, in a report published last week, revealed that it was able to make this connection by pivoting from Proton66-linked digital assets. This discovery led to the identification of an active threat cluster that leverages Visual Basic Script (VBS) files as its primary attack vector.

Key Findings

• Bulletproof Hosting: Proton66 provides robust and resilient hosting services, making it difficult for authorities to disrupt Blind Eagle’s operations.
• Phishing Campaigns: Blind Eagle uses VBS files to execute phishing attacks, targeting unsuspecting victims with malicious emails and links.
• RAT Deployment: Once access is gained, Blind Eagle deploys Remote Access Trojans (RATs) to maintain persistent control over compromised systems.
• Targeted Institutions: The primary targets of these attacks are Colombian banks, highlighting the financial sector’s vulnerability to such threats.

Impact and Implications

The use of bulletproof hosting services like Proton66 allows threat actors to operate with impunity, making it challenging for law enforcement and cybersecurity firms to mitigate these threats. The sophistication of Blind Eagle’s tactics underscores the need for enhanced cybersecurity measures, particularly in the financial sector.

Mitigation Strategies

• Enhanced Security Protocols: Financial institutions should implement robust security protocols to detect and prevent phishing attacks.
• Employee Training: Regular training sessions for employees to recognize and avoid phishing attempts.
• Collaboration with Cybersecurity Firms: Partnering with cybersecurity firms like Trustwave SpiderLabs can provide early detection and response to emerging threats.

Conclusion

The Blind Eagle threat actor’s use of Proton66 hosting for phishing and RAT deployment against Colombian banks highlights the evolving landscape of cyber threats. As these attacks become more sophisticated, it is crucial for organizations to stay vigilant and proactive in their cybersecurity strategies. For further insights, check:

Additional Resources

For further insights, check:

• The Hacker News