Home / Threat actors / APT-C-36
APT-C-36 G0099
Also known as: Blind Eagle, TAG-144, AguilaCiega, APT-Q-98
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
43
Techniques
9
Malware and tools
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Reconnaissance
T1593 Search Open Websites/Domains Resource Development
T1583.001 DomainsT1583.003 Virtual Private ServerT1583.006 Web ServicesT1584.005 BotnetT1586.002 Email AccountsT1586.003 Cloud AccountsT1587.001 MalwareT1588.001 MalwareT1588.002 ToolT1608.001 Upload MalwareT1683.001 Written ContentT1683.002 Audio-Visual Content Initial Access
T1133 External Remote ServicesT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1059.007 JavaScriptT1204.001 Malicious LinkT1204.002 Malicious FileT1574.001 DLL Persistence
T1053.005 Scheduled TaskT1133 External Remote Services Privilege Escalation
T1053.005 Scheduled TaskT1055.012 Process Hollowing Stealth
T1027 Obfuscated Files or InformationT1027.003 SteganographyT1027.013 Encrypted/Encoded FileT1027.016 Junk Code InsertionT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1055.012 Process HollowingT1480 Execution GuardrailsT1564.003 Hidden WindowT1574.001 DLLT1684.001 Impersonation Lateral Movement
T1534 Internal Spearphishing Command and Control
T1105 Ingress Tool TransferT1568 Dynamic ResolutionT1571 Non-Standard Port Malware and tools
- CaminhoMalwareS9016
- HeartCryptMalwareS9018
- njRATMalwareS0385
- PureCrypterMalwareS9019
- AsyncRATToolS1087
- DCRATToolS9017
- Imminent MonitorToolS0434
- QuasarRATToolS0262
- RemcosToolS0332
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.