APT-C-36
- ID
- G0099
- Associated names
- Blind Eagle, TAG-144, AguilaCiega, APT-Q-98
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]
Techniques used (38)
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1027.013 Encrypted/Encoded File
- T1027.016 Junk Code Insertion
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1055.012 Process Hollowing
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1105 Ingress Tool Transfer
- T1133 External Remote Services
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1480 Execution Guardrails
- T1534 Internal Spearphishing
- T1564.003 Hidden Window
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1568 Dynamic Resolution
- T1571 Non-Standard Port
- T1574.001 DLL
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.006 Web Services
- T1584.005 Botnet
- T1586.002 Email Accounts
- T1586.003 Cloud Accounts
- T1587.001 Malware
- T1588.001 Malware
- T1588.002 Tool
- T1593 Search Open Websites/Domains
- T1608.001 Upload Malware
- T1683.001 Written Content
- T1683.002 Audio-Visual Content
- T1684.001 Impersonation
Software used (9)
- S0262 QuasarRAT
- S0332 Remcos
- S0385 njRAT
- S0434 Imminent Monitor
- S1087 AsyncRAT
- S9016 Caminho
- S9017 DCRAT
- S9018 HeartCrypt
- S9019 PureCrypter