The cyber threat group known as Blind Eagle, or APT-C-36, is closely linked with the Russian bulletproof hosting company Proton66 and is actively targeting organizations in Latin America, particularly Colombian financial institutions. Recent investigations have unveiled a significant operational infrastructure used by this group, characterized by extensive interconnections among various domains and IP addresses. Their modus operandi primarily utilizes Visual Basic Script (VBS) files as the initial attack vector and incorporates free Dynamic DNS (DDNS) services to facilitate operation.