Watch Floor
CybercrimeMITRE G0099

APT-C-36

Also known as Blind Eagle, TAG-144, AguilaCiega, APT-Q-98

3mentions, 7 days
3mentions, 30 days
Nov 4, 2026last mentioned

Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc.

Targets: Petroleum, Manufacturing, Financial, Private sector, Government, Ecuador, Colombia, Spain, Panama, Chile

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1027 Obfuscated Files or InformationT1027.003 SteganographyT1027.013 Encrypted/Encoded FileT1027.016 Junk Code InsertionT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1055.012 Process HollowingT1059.001 PowerShellT1059.005 Visual BasicT1059.007 JavaScriptT1105 Ingress Tool TransferT1133 External Remote ServicesT1204.001 Malicious LinkT1204.002 Malicious FileT1480 Execution GuardrailsT1534 Internal SpearphishingT1564.003 Hidden WindowT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1568 Dynamic ResolutionT1571 Non-Standard PortT1574.001 DLLT1583.001 DomainsT1583.003 Virtual Private ServerT1583.006 Web ServicesT1584.005 BotnetT1586.002 Email AccountsT1586.003 Cloud AccountsT1587.001 MalwareT1588.001 MalwareT1588.002 ToolT1593 Search Open Websites/DomainsT1608.001 Upload MalwareT1683.001 Written ContentT1683.002 Audio-Visual ContentT1684.001 Impersonation

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.