Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT-C-36 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT-C-36

  • Blind Eagle
  • TAG-144
  • AguilaCiega
  • APT-Q-98

MITRE G0099 ↗

APT-C-36 — ATT&CK roseAP

attack rose · 38 techniques across 8 tactics

Analyst brief

misp-galaxy + mitre-attack

Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc.

Observed targets (as stated by the sources)

5 countries · 5 sectors
EcuadorColombiaSpainPanamaChile

assessed originnot stated by sourcesobserved targets · 5

countries · 5

  • Ecuador
  • Colombia
  • Spain
  • Panama
  • Chile

sectors · 5

  • Petroleum
  • Manufacturing
  • Financial
  • Private sector
  • Government

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

38 techniques · 8 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    12 techniques

  3. Initial access

    2 techniques

  4. Execution

    7 techniques

  5. Persistence

    1 technique

  6. Stealth

    11 techniques

  7. Lateral movement

    1 technique

  8. Command and control

    3 techniques

select a technique

Arsenal

4 malware · 5 tools
Malware
Malware · 4ATT&CK
njRATS0385 ↗
PureCrypterS9019 ↗
CaminhoS9016 ↗
HeartCryptS9018 ↗
Tools
Tools · 5ATT&CK
Imminent MonitorS0434 ↗
DCRATS9017 ↗
RemcosS0332 ↗
AsyncRATS1087 ↗
QuasarRATS0262 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023Blind Eagle Deploys Fake UUE Files and Fsociety to Target ColombiaBlackberry ↗
  2. 2023Analysis of activities of suspected APT-C-36 (Blind Eagle) organization launching Amadey botnet TrojanCoreSec360 ↗

Take it with you

keyless · no signup

References

12 sources
  1. 1.ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-co…
  2. 2.ecucert.gob.ec/wp-content/uploads/2022/03/alerta-APTs-2022-03-23.pdf
  3. 3.blogs.blackberry.com/en/2023/02/blind-eagle-apt-c-36-targets-colombia
  4. 4.lab52.io/blog/apt-c-36-recent-activity-analysis
  5. 5.trendmicro.com/en_ph/research/21/i/apt-c-36-updates-its-long-term-spa…
  6. 6.research.checkpoint.com/2023/blindeagle-targeting-ecuador-with-sharpened-tools
  7. 7.attack.mitre.org/groups/G0099
  8. 8.attack.mitre.org/groups/G0099
  9. 9.research.checkpoint.com/2025/blind-eagle-and-justice-for-all
  10. 10.securelist.com/blindeagle-apt/113414
  11. +2 more in the JSON record

Track APT-C-36 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.