APT-C-36 (Blind Eagle) is a suspected South American threat actor known for spearphishing campaigns deploying diverse RATs against government, petroleum, and financial sectors.
APT-C-36 (Blind Eagle) is a threat actor suspected to originate from South America. It primarily targets government institutions and corporations in the petroleum, manufacturing, and financial sectors across Colombia, Ecuador, Spain, Panama, and Chile. The group's key TTPs revolve around spearphishing (T1566.001, .002) with malicious attachments or links, delivering a diverse RAT toolkit including njRAT, Remcos, AsyncRAT, and PureCrypter, while using WMI (T1047) for execution and junk code (T1027.016) for evasion. Defenders should focus on email security gateways, monitoring for suspicious WMI and PowerShell activity, and blocking C2 infrastructure associated with known RAT families, especially those using Dynamic DNS (T1568).
Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc.
Monitor network traffic and user activity to detect searching open websites and domains.
Monitor DNS queries and web server logs to detect domain registration and content creation activities.
Analyze email content and user interaction to detect suspicious email attachments and links.
Monitor WMI logs and process creation events to detect suspicious WMI queries and executed files.
Monitor authentication logs and network connections to detect connections to external remote services.
Analyze process behavior and system changes to detect suspicious code insertion and impersonation activities.
Monitor email content and user interaction within the network to detect suspicious internal spearphishing activities.
Monitor network traffic and process behavior to detect suspicious ingress tool transfer and dynamic resolution activities.
It primarily targets government institutions and the petroleum, manufacturing, and financial sectors in Colombia, Ecuador, Spain, Panama, and Chile.
Their toolkit includes njRAT, Remcos, AsyncRAT, and PureCrypter.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.