Threat actors from the Blind Eagle (APT-C-36) organization have been the source of an ongoing campaign against Columbian entities. Blind Eagle actors are known for their continued targeting of financial and government entities throughout Latin America. Ongoing since 2019, these threat actors have been distributing a variety of themed phishing emails attempting to compromise multiple users to gain access to company infrastructure. One instance observed by researchers demonstrated the use of fake tax documentation claiming to originate from Columbia’s Directorate of National Taxes & Customs (DIAN). This type of lure has been used multiple times since the start of the campaign, as end-users often feel inclined to pay outstanding balances to tax agencies and uphold a good reputation with them. Embedded within these phishing emails was a fraudulent link to DIAN’s official website that, once clicked, loaded a threat actor-controlled website. After downloading a fraudulent PDF document from a Discord CDN, additional code is executed from the malicious PDF and eventually installs AsyncRAT onto the compromised system. While Columbia appears to be the main target of this 4-year campaign, additional countries including Ecuador, Chile, and Spain have also been targeted. CTIX analysts continue to monitor threat activity throughout the threat landscape and will provide additional updates accordingly.