THREAT_ACTOR · G0099
APT-C-36
Also known as: APT-C-36, Blind Eagle, TAG-144, AguilaCiega, APT-Q-98
Profile
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.
MITRE ATT&CK ↗Techniques
38 ATT&CK techniques attributed to this actor.
T1027 Obfuscated Files or InformationT1027.003 SteganographyT1027.013 Encrypted/Encoded FileT1027.016 Junk Code InsertionT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1055.012 Process HollowingT1059.001 PowerShellT1059.005 Visual BasicT1059.007 JavaScriptT1105 Ingress Tool TransferT1133 External Remote ServicesT1204.001 Malicious LinkT1204.002 Malicious FileT1480 Execution GuardrailsT1534 Internal SpearphishingT1564.003 Hidden WindowT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1568 Dynamic ResolutionT1571 Non-Standard PortT1574.001 DLLT1583.001 DomainsT1583.003 Virtual Private ServerT1583.006 Web ServicesT1584.005 BotnetT1586.002 Email AccountsT1586.003 Cloud AccountsT1587.001 MalwareT1588.001 MalwareT1588.002 ToolT1593 Search Open Websites/DomainsT1608.001 Upload MalwareT1683.001 Written ContentT1683.002 Audio-Visual ContentT1684.001 Impersonation
Software
9 malware/tools attributed to this actor.
QuasarRATRemcosnjRATImminent MonitorAsyncRATCaminhoDCRATHeartCryptPureCrypter
Related corpus activity
10,031 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to APT-C-36.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2026-3102 | cve | — | 85 | 3 |
| cve-2026-0740 | cve | — | 85 | 1 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2014-2321 | cve | — | 85 | 1 |
| cve-2025-34117 | cve | — | 85 | 1 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2020-17456 | cve | — | 85 | 1 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2013-7471 | cve | — | 85 | 1 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2021-4045 | cve | — | 85 | 1 |
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2017-18377 | cve | — | 85 | 1 |
| cve-2021-25646 | cve | — | 85 | 1 |
| cve-2026-3844 | cve | — | 85 | 1 |
Showing the top 30 by severity of 10,031.