MITRE ATT&CKgroup
G0099 APT-C-36
- Domain
- enterprise
- Aliases
- Blind Eagle, TAG-144, AguilaCiega, APT-Q-98
- Version
- 2.0
- Created
- 2020-05-05
Description
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.
Related
Uses · MITRE ATT&CK (47)
- S9016 Caminho software (malware)
- S9017 DCRAT software (tool)
- S9018 HeartCrypt software (malware)
- S9019 PureCrypter software (malware)
- T1684.001 Impersonation sub-technique
- T1683.001 Written Content sub-technique
- T1683.002 Audio-Visual Content sub-technique
- T1027.016 Junk Code Insertion sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- S1087 AsyncRAT software (tool)
- T1586.003 Cloud Accounts sub-technique
- T1608.001 Upload Malware sub-technique
- T1593 Search Open Websites/Domains technique
- T1583.003 Virtual Private Server sub-technique
- T1583.006 Web Services sub-technique
- T1584.005 Botnet sub-technique
- T1586.002 Email Accounts sub-technique
- T1587.001 Malware sub-technique
- T1588.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1059.007 JavaScript sub-technique
- S0434 Imminent Monitor software (tool)
- T1571 Non-Standard Port technique
- T1564.003 Hidden Window sub-technique
- T1574.001 DLL sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1568 Dynamic Resolution technique
- T1059.001 PowerShell sub-technique
References
- https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/ Check Point Blind Eagle MAR 2025
- https://securelist.com/blindeagle-apt/113414/ Kaspersky BlindEagle AUG 2024
- https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf Recorded Future TAG-144 AUG 2025
- https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/ QiAnXin APT-C-36 Feb2019