APT-C-36
Also tracked as Blind Eagle, TAG-144, AguilaCiega, APT-Q-98
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.
- Documented techniques
- 38
- Assessed motivation
- Espionage, Financial gain
- First seen
- 2018
- Basis
- MITRE ATT&CK
How they break in
Techniques MITRE has documented this group using, grouped by the stage of an attack they belong to. This is the actionable half: each one is a behaviour you can look for in your own logs, and a control you can test.
reconnaissance1
resource development12
execution7
persistence1
lateral movement1
command and control3
stealth11
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1027.013 Encrypted/Encoded File
- T1027.016 Junk Code Insertion
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1055.012 Process Hollowing
- T1480 Execution Guardrails
- T1564.003 Hidden Window
- T1574.001 DLL
- T1684.001 Impersonation
Malware
Families MITRE records this group deploying. Detection names for these are a reasonable place to start.
Tools
Legitimate or dual-use software the group is documented using. Most of it is software your own administrators use too, which is the point.