APT-C-36
Blind EagleTAG-144AguilaCiegaAPT-Q-98
Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc. Fuente: MISP
Actividad en Jábega · 12 semanas
1 noticias · vista por primera vez el 10 nov 2026 · la última, el 10 nov 2026
Noticias
- Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin AmericaThe Hacker News · 10 nov 2026
Técnicas MITRE ATT&CK
Reconocimiento
Preparación de recursos
T1583.001DomainsT1583.003Virtual Private ServerT1583.006Web ServicesT1584.005BotnetT1586.002Email AccountsT1586.003Cloud Accounts 1 reglas SigmaT1587.001Malware 10 reglas SigmaT1588.001Malware 1 reglas SigmaT1588.002Tool 7 reglas SigmaT1608.001Upload MalwareT1683.001Written ContentT1683.002Audio-Visual Content
Acceso inicial
T1133External Remote Services 17 reglas SigmaT1566.001Spearphishing Attachment 21 reglas SigmaT1566.002Spearphishing Link 3 reglas Sigma
Ejecución
T1047Windows Management Instrumentation 40 reglas SigmaT1053.005Scheduled Task 40 reglas SigmaT1059.001PowerShell 40 reglas SigmaT1059.005Visual Basic 28 reglas SigmaT1059.007JavaScript 26 reglas SigmaT1204.001Malicious Link 4 reglas SigmaT1204.002Malicious File 32 reglas SigmaT1574.001DLL 40 reglas Sigma
Escalada de privilegios
Movimiento lateral
Mando y control
T1105Ingress Tool Transfer 40 reglas SigmaT1568Dynamic Resolution 4 reglas SigmaT1571Non-Standard Port 5 reglas Sigma
Stealth
T1027Obfuscated Files or Information 61 reglas SigmaT1027.003Steganography 1 reglas SigmaT1027.013Encrypted/Encoded FileT1027.016Junk Code InsertionT1036.004Masquerade Task or Service 3 reglas SigmaT1036.005Match Legitimate Resource Name or Location 20 reglas SigmaT1480Execution GuardrailsT1564.003Hidden Window 7 reglas SigmaT1684.001Impersonation
Relaciones por coaparición en noticias, no atribución. Fuentes: MISP galaxy, MITRE ATT&CK y SigmaHQ. attack.mitre.org ↗