216.73.217.22

APT-C-36

· Published 16/12/2025 19:39 · Modified 04/05/2026 16:33 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
04/05/2026 16:33
Updated at
04/05/2026 16:33
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
1 reports, 79 attack patterns (mitre), 10 malware, 4 sectors, 5 countries, 95 indicators, 1 vulnerabilities (cve), 5 tool

Aliases

Blind Eagle

Description

[APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South America espionage group that has been active since at least 2018. The group mainly targets Colombian government institutions as well as important corporations in the financial sector, petroleum industry, and professional manufacturing.(Citation: QiAnXin APT-C-36 Feb2019)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (79)

Malware (10)

  • njRAT - S0385 uses
    Family
    Published 16/09/2025 13:41 · Modified 16/09/2025 13:41
  • AsyncRAT uses
    Family
    Published 11/06/2026 16:31 · Modified 11/06/2026 16:31
  • Hijackloader uses
    Family
    Published 10/06/2026 11:58 · Modified 10/06/2026 11:58
  • Quasar RAT uses
    Family
    Published 15/05/2026 15:23 · Modified 15/05/2026 15:23
  • Remcos RAT uses
    Family
    Published 17/06/2026 18:20 · Modified 17/06/2026 18:20
  • NJRat uses
    Family
    Published 05/03/2025 11:12 · Modified 05/03/2025 11:12
  • Backdoor:MSIL/Quasar
  • PureCrypter uses
    Family
    Published 10/10/2025 08:25 · Modified 10/10/2025 08:25
  • Caminho uses
    Family
    Published 17/12/2025 02:49 · Modified 17/12/2025 02:49
  • HEARTCRYPT uses
    Family
    Published 20/03/2025 15:17 · Modified 20/03/2025 15:17

Sectors (4)

  • Defense targets
  • Government targets
  • Finance targets
  • Manufacturing targets

Countries (5)

  • Spain targets
  • United States of America targets
  • Ecuador targets
  • Colombia targets
  • Chile targets

Indicators (95)

Vulnerabilities (CVE) (1)

CVE-2024-43451 KEV
6.5 Medium

Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a …

Attack vector
Network
Published
12/11/2024
Modified
27/05/2026
Analyzed

Tool (5)

  • DCRAT uses
    The MITRE Corporation Confidence 75

    [DCRAT](https://attack.mitre.org/software/S9017) is a variant of the open-source [AsyncRAT](https://attack.mitre.org/software/S1087) developed in C# with additional capabilities such as patching Microsoft’s Antimalware Scan Interface (AMSI).(Citation: Zscaler BlindEagle DEC 2025)

    Published 16/04/2026 20:23 · Modified 04/05/2026 16:31
  • Remcos uses
    The MITRE Corporation Confidence 100

    [Remcos](https://attack.mitre.org/software/S0332) is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. [Remcos](https://attack.mitre.org/software/S0332) has been observed being used in …

    Published 29/01/2019 19:55 · Modified 27/03/2026 01:07
  • QuasarRAT uses
    The MITRE Corporation Confidence 100

    [QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language.(Citation: GitHub QuasarRAT)(Citation: Volexity …

    Published 17/10/2018 02:14 · Modified 27/03/2026 01:07
  • AsyncRAT uses
    The MITRE Corporation Confidence 100

    [AsyncRAT](https://attack.mitre.org/software/S1087) is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.(Citation: Morphisec Snip3 May 2021)(Citation: Cisco Operation Layover …

    Published 20/09/2023 19:32 · Modified 27/03/2026 01:07
  • Imminent Monitor uses
    The MITRE Corporation Confidence 100

    [Imminent Monitor](https://attack.mitre.org/software/S0434) was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. …

    Published 05/05/2020 20:45 · Modified 27/03/2026 01:07