APT-C-36
Blind EagleTAG-144AguilaCiegaAPT-Q-98
Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc. Source: MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 10 Nov 2026 · last seen on 10 Nov 2026
News
- Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin AmericaThe Hacker News · 10 Nov 2026
MITRE ATT&CK techniques
Reconnaissance
Resource Development
T1583.001DomainsT1583.003Virtual Private ServerT1583.006Web ServicesT1584.005BotnetT1586.002Email AccountsT1586.003Cloud Accounts 1 Sigma rulesT1587.001Malware 10 Sigma rulesT1588.001Malware 1 Sigma rulesT1588.002Tool 7 Sigma rulesT1608.001Upload MalwareT1683.001Written ContentT1683.002Audio-Visual Content
Initial Access
T1133External Remote Services 17 Sigma rulesT1566.001Spearphishing Attachment 21 Sigma rulesT1566.002Spearphishing Link 3 Sigma rules
Execution
T1047Windows Management Instrumentation 40 Sigma rulesT1053.005Scheduled Task 40 Sigma rulesT1059.001PowerShell 40 Sigma rulesT1059.005Visual Basic 28 Sigma rulesT1059.007JavaScript 26 Sigma rulesT1204.001Malicious Link 4 Sigma rulesT1204.002Malicious File 32 Sigma rulesT1574.001DLL 40 Sigma rules
Privilege Escalation
Lateral Movement
Command and Control
T1105Ingress Tool Transfer 40 Sigma rulesT1568Dynamic Resolution 4 Sigma rulesT1571Non-Standard Port 5 Sigma rules
Stealth
T1027Obfuscated Files or Information 61 Sigma rulesT1027.003Steganography 1 Sigma rulesT1027.013Encrypted/Encoded FileT1027.016Junk Code InsertionT1036.004Masquerade Task or Service 3 Sigma rulesT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1480Execution GuardrailsT1564.003Hidden Window 7 Sigma rulesT1684.001Impersonation
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗