Zscaler BlindEagle DEC 2025

Caminho can use junk code for obfuscation.

APT-C-36 has used steganography to hide malicious code, typically in the resource section of executable files.

The DCRAT configuration file is encrypted using AES-256.

Caminho can use code flattening for payload obfuscation.

APT-C-36 has used WMI to execute PowerShell.

Caminho has launched and hollowed out MSBuild.exe to host malicious code.

DCRAT can log keystrokes on targeted systems.

APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads.

APT-C-36 has used a fileless attack chain composed of three JavaScript code snippets to execute subsequent payloads.

Caminho has the ability to download files onto compromised hosts.

Caminho can use `System.Net.WebClient.downloadString()` for file download.

Caminho can deobfuscate downloaded files prior to execution.

APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload. APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.

APT-C-36 has used a compromised account to send a phishing email to an address likely used and monitored by the IT team within the same targeted organization.

APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution.

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.

DCRAT can use certificate-based authentication for C2 servers.

APT-C-36 has acquired domains to host malicious payloads.

APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.

APT-C-36 has regularly used compromised email accounts in spearphishing campaigns.

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.

DCRAT can patch Microsoft’s Antimalware Scan Interface (AMSI) to evade detection.