Threat intelligence / Group

APT-C-36

[APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. [APT-C-36](https://attack.mitre.org/groups/G0099) has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.(Citation: QiAnXin APT-C-36 Feb2019)(Citation: Kaspersky BlindEagle AUG 2024)(Citation: Check Point Blind Eagle MAR 2025)(Citation: Recorded Future TAG-144 AUG 2025)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

47 recorded

Relationships

uses

to AsyncRAT

Tool

uses

to Audio-Visual Content

Technique

uses

to Botnet

Technique

uses

to Caminho

Malware

uses

to Cloud Accounts

Technique

uses

to DCRAT

Tool

uses

to DLL

Technique

uses

to Domains

Technique

uses

to Dynamic Resolution

Technique

uses

to Email Accounts

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to External Remote Services

Technique

uses

to HeartCrypt

Malware

uses

to Hidden Window

Technique

uses

to Imminent Monitor

Tool

uses

to Impersonation

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internal Spearphishing

Technique

uses

to JavaScript

Technique

uses

to Junk Code Insertion

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Malware

Technique

uses

to Malware

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to njRAT

Malware

uses

to Non-Standard Port

Technique

uses

to Obfuscated Files or Information

Technique

uses

to PowerShell

Technique

uses

to Process Hollowing

Technique

uses

to PureCrypter

Malware

uses

to QuasarRAT

Tool

uses

to Remcos

Tool

uses

to Scheduled Task

Technique

uses

to Search Open Websites/Domains

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Steganography

Technique

uses

to Tool

Technique

uses

to Upload Malware

Technique

uses

to Virtual Private Server

Technique

uses

to Visual Basic

Technique

uses

to Web Services

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Written Content

Technique

9 external

References

mitre-attack

G0099

open

Blind Eagle

—

TAG-144

—

AguilaCiega

—

APT-Q-98

—

Check Point Blind Eagle MAR 2025

https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/

open

Kaspersky BlindEagle AUG 2024

https://securelist.com/blindeagle-apt/113414/

open

Recorded Future TAG-144 AUG 2025

https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf

open

QiAnXin APT-C-36 Feb2019

https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/

open