1. Home
  2. Groups
  3. APT-C-36

APT-C-36

APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]

ID: G0099
ⓘ
Associated Groups: Blind Eagle, TAG-144, AguilaCiega, APT-Q-98
Contributors: Jose Luis Sánchez Martinez
Version: 2.0
Created: 05 May 2020
Last Modified: 23 April 2026

Associated Group Descriptions

Name Description
Blind Eagle

[1][4]
TAG-144

[4]
AguilaCiega

[4]
APT-Q-98

[4]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1583 .001 Acquire Infrastructure: Domains

APT-C-36 has acquired domains to host malicious payloads.[2][3][5][4][4][6]
.003 Acquire Infrastructure: Virtual Private Server

APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure.[4]
.006 Acquire Infrastructure: Web Services

APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.[2][3][4][6]
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads.[2][6]
.005 Command and Scripting Interpreter: Visual Basic

APT-C-36 has used VBScript for initial malware deployment including within a malicious Word document which is executed upon the document opening.[1][2][5]
.007 Command and Scripting Interpreter: JavaScript

APT-C-36 has used a fileless attack chain composed of three JavaScript code snippets to execute subsequent payloads.[6]
Enterprise T1586 .002 Compromise Accounts: Email Accounts

APT-C-36 has regularly used compromised email accounts in spearphishing campaigns.[4][6]
.003 Compromise Accounts: Cloud Accounts

APT-C-36 has used compromised Google Drive accounts including one associated with a Colombian government organization.[4]
Enterprise T1584 .005 Compromise Infrastructure: Botnet

APT-C-36 has used a botnet management interface to control large numbers of compromised hosts.[5]
Enterprise T1587 .001 Develop Capabilities: Malware

APT-C-36 has customized existing malware with new capabilities including njRAT, AsyncRAT, LimeRAT, and BitRAT.[2]
Enterprise T1568 Dynamic Resolution

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.[2][3][5][4][6]
Enterprise T1480 Execution Guardrails

APT-C-36 has used geolocation filtering in malware delivery to redirect traffic not coming from a targeted region or country, such as Ecuador or Colombia, to legitimate sites.[2][4]
Enterprise T1133 External Remote Services

APT-C-36 has used VPNs in their operational infrastructure.[4]
Enterprise T1683 .001 Generate Content: Written Content

APT-C-36 has generated email content impersonating official notifications and documents that direct victims to execute malicious payloads.[2]
.002 Generate Content: Audio-Visual Content

APT-C-36 has used phishing pages appearing like legitimate banking login portals to compromise credentials.[5]
Enterprise T1564 .003 Hide Artifacts: Hidden Window

APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution.[6]
Enterprise T1574 .001 Hijack Execution Flow: DLL

APT-C-36 has used side-loading to execute the HijackLoader payload.[2]
Enterprise T1105 Ingress Tool Transfer

APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.[1]
Enterprise T1534 Internal Spearphishing

APT-C-36 has used a compromised account to send a phishing email to an address likely used and monitored by the IT team within the same targeted organization.[6]
Enterprise T1036 .004 Masquerading: Masquerade Task or Service

APT-C-36 has disguised its scheduled tasks as those used by Google.[1]
.005 Masquerading: Match Legitimate Resource Name or Location

APT-C-36 has disguised malicious executables to appear as legitimate files.[2]
Enterprise T1571 Non-Standard Port

APT-C-36 has used port 4050 for C2 communications.[1]
Enterprise T1027 Obfuscated Files or Information

APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection.[1] APT-C-36 has also compressed initial droppers into ZIP, LHA and UUE formats.[2]
.003 Steganography

APT-C-36 has used steganography to hide malicious code, typically in the resource section of executable files.[2][4][4][6]
.013 Encrypted/Encoded File

APT-C-36 has used encoded and obfuscated files, images, and executables.[2]
.016 Junk Code Insertion

APT-C-36 has used junk characters to obfuscate malicious scripts.[4]
Enterprise T1588 .001 Obtain Capabilities: Malware

APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.[3][5][4]
.002 Obtain Capabilities: Tool

APT-C-36 utilizes tools well known in crime communities and has obtained and used a modified variant of Imminent Monitor.[1][3]
Enterprise T1566 .001 Phishing: Spearphishing Attachment

APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway.[1][2][4][4]
.002 Phishing: Spearphishing Link

APT-C-36 has sent emails containing a link that appear to lead to an urgent notification from a government institution, at times using URL shorteners like cort[.]as, acortaurl[.]com, and gtly[.]to.[2][3][3][4]
Enterprise T1055 .012 Process Injection: Process Hollowing

APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes.[2]
Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.[1]
Enterprise T1593 Search Open Websites/Domains

APT-C-36 has gathered information on Colombian financial institutions, including Bancolombia, BBVA, Banco Caja Social, and Davivienda to craft phishing pages.[5]
Enterprise T1684 .001 Social Engineering: Impersonation

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.[2][5][4][6]
Enterprise T1608 .001 Stage Capabilities: Upload Malware

APT-C-36 has staged malware implants on group-owned repositories and sites.[2][5]
Enterprise T1204 .001 User Execution: Malicious Link

APT-C-36 has used malicious links in emails, often impersonating official notifications and documents, to direct users to execute malicious payloads.[2]
.002 User Execution: Malicious File

APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload.[1][4] APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.[3][6]
Enterprise T1047 Windows Management Instrumentation

APT-C-36 has used WMI to execute PowerShell.[6]

Software

ID Name References Techniques
S1087 AsyncRAT APT-C-36 has used a customized version of AsyncRAT.[2][3][5][4] Command and Scripting Interpreter: Windows Command Shell, Debugger Evasion, Dynamic Resolution: Domain Generation Algorithms, Dynamic Resolution, Hide Artifacts: Hidden Window, Ingress Tool Transfer, Input Capture: Keylogging, Local Storage Discovery, Native API, Phishing: Spearphishing Attachment, Process Discovery, Proxy: Multi-hop Proxy, Scheduled Task/Job: Scheduled Task, Screen Capture, System Network Configuration Discovery, System Owner/User Discovery, System Time Discovery, User Execution: Malicious File, Video Capture, Virtualization/Sandbox Evasion: System Checks
S9016 Caminho APT-C-36 has used Caminho during operations.[6] Deobfuscate/Decode Files or Information, Ingress Tool Transfer, Native API, Obfuscated Files or Information: Binary Padding, Obfuscated Files or Information: Encrypted/Encoded File, Process Injection: Process Hollowing
S9017 DCRAT APT-C-36 has used DCRAT during operations.[6] Disable or Modify Tools, Encrypted Channel: Asymmetric Cryptography, Input Capture: Keylogging, Obfuscated Files or Information: Encrypted/Encoded File
S9018 HeartCrypt APT-C-36 has used HeartCrypt in Remcos infection chains.[3] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Deobfuscate/Decode Files or Information, Masquerading: Masquerade File Type, Native API, Obfuscated Files or Information: Software Packing, Obfuscated Files or Information: Encrypted/Encoded File, Obfuscated Files or Information: Binary Padding, Process Injection: Asynchronous Procedure Call, Process Injection: Process Hollowing, Virtualization/Sandbox Evasion: System Checks
S0434 Imminent Monitor [1] Audio Capture, Command and Scripting Interpreter, Credentials from Password Stores: Credentials from Web Browsers, Deobfuscate/Decode Files or Information, Disable or Modify Tools, Exfiltration Over C2 Channel, File and Directory Discovery, Hide Artifacts: Hidden Files and Directories, Indicator Removal: File Deletion, Input Capture: Keylogging, Native API, Obfuscated Files or Information, Process Discovery, Remote Services: Remote Desktop Protocol, Resource Hijacking: Compute Hijacking, Video Capture
S0385 njRAT APT-C-36 has used a customized version of njRAT.[2][3][4] Application Layer Protocol: Web Protocols, Application Window Discovery, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: PowerShell, Command and Scripting Interpreter: Windows Command Shell, Credentials from Password Stores: Credentials from Web Browsers, Data Encoding: Standard Encoding, Data from Local System, Disable or Modify System Firewall: Windows Host Firewall, Dynamic Resolution: Fast Flux DNS, Exfiltration Over C2 Channel, File and Directory Discovery, Indicator Removal: File Deletion, Indicator Removal: Clear Persistence, Ingress Tool Transfer, Input Capture: Keylogging, Modify Registry, Native API, Non-Standard Port, Obfuscated Files or Information: Encrypted/Encoded File, Obfuscated Files or Information: Compile After Delivery, Peripheral Device Discovery, Process Discovery, Query Registry, Remote Services: Remote Desktop Protocol, Remote System Discovery, Replication Through Removable Media, Screen Capture, System Information Discovery, System Owner/User Discovery, Video Capture
S9019 PureCrypter APT-C-36 has used PureCrypter during operations.[3] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: PowerShell, Debugger Evasion, Delay Execution, Deobfuscate/Decode Files or Information, Disable or Modify Tools, Encrypted Channel: Asymmetric Cryptography, Encrypted Channel: Symmetric Cryptography, Execution Guardrails: Mutual Exclusion, Execution Guardrails, Hide Artifacts: Hidden Window, Indicator Removal: File Deletion, Ingress Tool Transfer, Masquerading: Match Legitimate Resource Name or Location, Masquerading: Masquerade File Type, Obfuscated Files or Information: Junk Code Insertion, Obfuscated Files or Information: Encrypted/Encoded File, Process Discovery, Process Injection, Scheduled Task/Job: Scheduled Task, Software Discovery: Security Software Discovery, System Information Discovery, System Location Discovery, System Owner/User Discovery, Virtual Machine Discovery, Web Service
S0262 QuasarRAT APT-C-36 has used a customized version of QuasarRAT known as BlotchyQuasar.[4][2] Abuse Elevation Control Mechanism: Bypass User Account Control, Application Window Discovery, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Credentials from Password Stores: Credentials from Web Browsers, Credentials from Password Stores, Data from Local System, Encrypted Channel: Symmetric Cryptography, Hide Artifacts: Hidden Window, Hide Artifacts: Hidden Files and Directories, Ingress Tool Transfer, Input Capture: Keylogging, Modify Registry, Non-Application Layer Protocol, Non-Standard Port, Proxy, Remote Services: Remote Desktop Protocol, Scheduled Task/Job: Scheduled Task, Subvert Trust Controls: Code Signing, System Information Discovery, System Location Discovery, System Network Configuration Discovery, System Owner/User Discovery, Unsecured Credentials: Credentials In Files, Video Capture
S0332 Remcos APT-C-36 used Remcos during operations.[3][5][4][6] Abuse Elevation Control Mechanism: Bypass User Account Control, Application Window Discovery, Archive Collected Data: Archive via Utility, Audio Capture, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Clipboard Data, Command and Scripting Interpreter: Python, Command and Scripting Interpreter: Windows Command Shell, Command and Scripting Interpreter: Visual Basic, Command and Scripting Interpreter: JavaScript, Create or Modify System Process: Windows Service, Data Encoding: Standard Encoding, Defacement: Internal Defacement, Dynamic Resolution, Encrypted Channel: Asymmetric Cryptography, File and Directory Discovery, Hide Artifacts: Hidden Window, Hide Artifacts, Indicator Removal, Indicator Removal: File Deletion, Ingress Tool Transfer, Input Capture: Keylogging, Modify Registry, Obfuscated Files or Information, Obfuscated Files or Information: Encrypted/Encoded File, Phishing: Spearphishing Attachment, Process Discovery, Process Injection, Proxy, Query Registry, Screen Capture, System Information Discovery, System Location Discovery, System Owner/User Discovery, System Shutdown/Reboot, User Execution: Malicious File, Video Capture, Virtualization/Sandbox Evasion: System Checks

References

  1. QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.
  2. Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.
  3. Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.
  1. Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.
  2. Melnyk, S. (2025, June 27). Tracing Blind Eagle to Proton66. Retrieved April 16, 2026.
  3. Pellegrino, G. (2025, December 16). BlindEagle Targets Colombian Government Agency with Caminho and DCRAT. Retrieved April 16, 2026.