- Category
- State · Attributed to a state or working for one.
- Origin
- Colombia(high confidence)
- Motivation
- Espionage; Financial crime; Information theft and espionage
- Seen
- 2018–2026
- Status
- Active
- ATT&CK
- G0099 · 38 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0039 · apt-c-36
ColombiaWhat it is
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Blind Spider
- MITRE ATT&CK
- G0099
- QiAnXin
- APT-Q-98
- Recorded Future
- TAG-144
- Other names
- Blind Eagle, AguilaCiega
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTColombia
- ThreatActor.info (Malpedia et al.)Colombia · high
Targets
- Countries
- Chile, Colombia, Ecuador, Panama, Spain, United States
- Sectors
- Education, Energy, Financial, Government, Healthcare, Manufacturing, Petroleum, Private sector, Transportation
Tools
The tools and malware families the sources tie to it.
- AsyncRAT
- BitRAT
- BlotchyQuasar
- Caminho
- DCRAT
- HeartCrypt
- Imminent Monitor
- Imminent Monitor RAT
- Imminent RAT
- LimeRAT
- PureCrypter
- QuasarRAT
- Remcos
- RemcosRAT
- Warzone RAT
- njRAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net