Threat Actor Profile
High APT
Description

APT-C-36is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018.APT-C-36has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]

Confidence Score
100%
Tags
mitre-attack crawled web-source mitre-group
First Seen

Unknown

Last Updated

April 29, 2026
18 hours, 44 minutes ago

Active Status
Active
Created

April 29, 2026

MITRE ATT&CK Techniques (23)
T1105 - Ingress Tool Transfer
Command and Control
T1568 - Dynamic Resolution
Command and Control
T1571 - Non-Standard Port
Command and Control
T1027 - Obfuscated Files or Information
Defense Evasion
T1036 - Masquerading
Defense Evasion
T1055 - Process Injection
Defense Evasion
T1480 - Execution Guardrails
Defense Evasion
T1564 - Hide Artifacts
Defense Evasion
T1047 - Windows Management Instrumentation
Execution
T1053 - Scheduled Task/Job
Execution
T1059 - Command and Scripting Interpreter
Execution
T1204 - User Execution
Execution
T1566 - Phishing
Initial Access
T1534 - Internal Spearphishing
Lateral Movement
T1133 - External Remote Services
Persistence
T1574 - Hijack Execution Flow
Persistence
T1593 - Search Open Websites/Domains
Reconnaissance
T1583 - Acquire Infrastructure
Resource Development
T1584 - Compromise Infrastructure
Resource Development
T1586 - Compromise Accounts
Resource Development
T1587 - Develop Capabilities
Resource Development
T1588 - Obtain Capabilities
Resource Development
T1608 - Stage Capabilities
Resource Development
Indicators of Compromise

Loading IOCs…

IOC KQL for Sentinel
STIX Data
{'aliases': [],
 'description': 'APT-C-36is a suspected South American threat group that has '
                'engaged in espionage and financially motivated operations '
                'since at least 2018.APT-C-36has targeted government '
                'institutions and entities in the financial, energy, and '
                'professional manufacturing sectors across Colombia and other '
                'Latin American countries.[1][2][3][4]',
 'external_references': [{'external_id': 'G0099',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0099/'}],
 'id': 'threat-actor--G0099',
 'metadata': {'crawled_at': '2026-04-29T14:32:30.089722+00:00',
              'mitre_group_id': 'G0099',
              'page_title': 'APT-C-36, Blind Eagle, TAG-144, AguilaCiega, '
                            'APT-Q-98, Group G0099 | MITRE ATT&CK®'},
 'name': 'APT-C-36',
 'type': 'threat-actor'}
Quick Actions
Related TTPs (23)
Ingress Tool Transfer
Command and Control

Dynamic Resolution
Command and Control

Non-Standard Port
Command and Control

Obfuscated Files or Informati…
Defense Evasion

Masquerading
Defense Evasion