Home/ Threat Actors/ APT-C-36

🌐APT-C-36

🌐 APT-C-36 is a tracked threat actor in the Clankerusecase corpus. ??-aligned. Primary motivation: State. We map 14 detection use cases to this actor across 38 MITRE ATT&CK techniques, with 0 threat-intel articles citing them.

View full actor card → All threat actors MITRE ATT&CK group spec (G0099) ↗

14Use cases

0Articles

38Techniques

0IOCs

About this actor (MITRE)

[APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. [APT-C-36](https://attack.mitre.org/groups/G0099) has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.(Citation: QiAnXin APT-C-36 Feb2019)(Citation: Kaspersky BlindEagle AUG 2024)(Citation: Check Point Blind Eagle MAR 2025)(Citation: Recorded Future TAG-144 AUG 2025)

Known aliases

APT-C-36Blind EagleTAG-144AguilaCiegaAPT-Q-98

Top techniques

T1027 · Obfuscated Files or Information T1027.003 · Steganography T1027.013 · Encrypted/Encoded File

All other tracked techniques

T1027.016 · Junk Code Insertion T1036.004 · Masquerade Task or Service T1036.005 · Match Legitimate Resource Name or Location T1047 · Windows Management Instrumentation T1053.005 · Scheduled Task T1055.012 · Process Hollowing T1059.001 · PowerShell T1059.005 · Visual Basic T1059.007 · JavaScript T1105 · Ingress Tool Transfer T1133 · External Remote Services T1204.001 · Malicious Link T1204.002 · Malicious File T1480 · Execution Guardrails T1534 · Internal Spearphishing T1564.003 · Hidden Window T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing Link T1568 · Dynamic Resolution T1571 · Non-Standard Port T1574.001 · DLL T1583.001 · Domains T1583.003 · Virtual Private Server T1583.006 · Web Services T1584.005 · Botnet T1586.002 · Email Accounts T1586.003 · Cloud Accounts T1587.001 · Malware T1588.001 · Malware T1588.002 · Tool T1593 · Search Open Websites/Domains T1608.001 · Upload Malware T1683.001 · Written Content T1683.002 · Audio-Visual Content T1684.001 · Impersonation

Detection use cases (14)

APT-C-36 (Blind Eagle) staged loader: LOLBin fetch from public hosting → .NET utility process hollowing AI · profile S APT-C-36 (Blind Eagle) AsyncRAT/Remcos beacon to dynamic-DNS C2 from non-browser process AI · profile SΣ Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer package install spawning script-host with non-registry C2 within 5 minutes MITRE match Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution MITRE match Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress MITRE match npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules MITRE match OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay MITRE match Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access MITRE match Package Manager Install Hook Spawns Scripting Interpreter Then Touches Credential Files or Egresses Off-Registry MITRE match