Threat actors associated with the Blind Eagle threat organization (APT-C-36) have recently launched major phishing operations in an apparent resurgence of the group. Active since 2018, Blind Eagle is a financially motivated organization targeting entities throughout various South American countries, including entities within manufacturing, financial, and oil/gas industries. This type of activity has been seen in the apparent resurgence from the group during their recent campaign. Blind Eagle actors launched campaigns with improved infection chains and customized tooling, mainly targeting organizations in Colombia and Ecuador. Phishing emails distributed by threat actors in this campaign generically imitate a government institution and contain a malicious URL and PDF file attachment. Unlike other recent phishing campaigns, Blind Eagle threat actors employ a geofencing protocol to only execute malicious code for users within the allowed area (in this case, Colombia, and Ecuador). Otherwise, the malicious code will not execute and the user will be redirected to a legitimate website of the imitated government entity. The malware, “QuasarRAT”, detonated in this campaign is unusual in the fact that the malware is typically associated with cyber-espionage operations from other threat organizations. Analysis of the embedded code shows that Blind Eagle actors utilized QuasarRAT to gather banking information from these compromised devices, fitting their modus operandi. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.