AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
APT-C-36
Aliases: APT-C-36, APT-Q-98, AguilaCiega, Blind Eagle, TAG-144
[APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. [APT-C-36](https://attack.mitre.org/groups/G0099) has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.(Citation: QiAnXin APT-C-36 Feb2019)(Citation: Kaspersky BlindEagle AUG 2024)(Citation: Check Point Blind Eagle MAR 2025)(Citation: Recorded Future TAG-144 AUG 2025)
Open interactive actor investigation
ATT&CK techniques
T1027T1027.003T1027.013T1027.016T1036.004T1036.005T1047T1053.005T1055.012T1059.001T1059.005T1059.007T1105T1133T1204.001T1204.002T1480T1534T1564.003T1566.001T1566.002T1568T1571T1574.001T1583.001T1583.003T1583.006T1584.005T1586.002T1586.003T1587.001T1588.001T1588.002T1593T1608.001T1683.001T1683.002T1684.001
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- QuasarRAT tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Remcos tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Imminent Monitor tool reference — Explicit actor uses software relationship in pinned ATT&CK
- AsyncRAT tool reference — Explicit actor uses software relationship in pinned ATT&CK
- DCRAT tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1027 Obfuscated Files or Information simulation — Exact active technique ID
- T1027 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.003 Steganography simulation — Exact active technique ID
- T1027.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.013 Encrypted/Encoded File simulation — Exact active technique ID
- T1027.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.016 Junk Code Insertion simulation — Exact active technique ID
- T1027.016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.004 Masquerade Task or Service simulation — Exact active technique ID
- T1036.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055.012 Process Hollowing simulation — Exact active technique ID
- T1055.012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.005 Visual Basic simulation — Exact active technique ID
- T1059.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.007 JavaScript simulation — Exact active technique ID
- T1059.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1480 Execution Guardrails simulation — Exact active technique ID
- T1480 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1534 Internal Spearphishing simulation — Exact active technique ID
- T1534 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.003 Hidden Window simulation — Exact active technique ID
- T1564.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1568 Dynamic Resolution simulation — Exact active technique ID
- T1568 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1571 Non-Standard Port simulation — Exact active technique ID
- T1571 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.001 DLL simulation — Exact active technique ID
- T1574.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.003 Virtual Private Server simulation — Exact active technique ID
- T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.006 Web Services simulation — Exact active technique ID
- T1583.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.005 Botnet simulation — Exact active technique ID
- T1584.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.002 Email Accounts simulation — Exact active technique ID
- T1586.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.003 Cloud Accounts simulation — Exact active technique ID
- T1586.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.001 Malware simulation — Exact active technique ID
- T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.001 Malware simulation — Exact active technique ID
- T1588.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1593 Search Open Websites/Domains simulation — Exact active technique ID
- T1593 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1608.001 Upload Malware simulation — Exact active technique ID
- T1608.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1683.001 Written Content simulation — Exact active technique ID
- T1683.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1683.002 Audio-Visual Content simulation — Exact active technique ID
- T1683.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684.001 Impersonation simulation — Exact active technique ID
- T1684.001 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameMobile and Android vulnerability research
Vulnerability Research & Exploit Development · explicit-nameModule 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-nameModule 7 — Intelligence Products Sharing
Cyber Threat Intelligence (CTI) · explicit-nameModule 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-name
Blue Team & Defensive Security · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameMobile and Android vulnerability research
Vulnerability Research & Exploit Development · explicit-nameModule 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-nameModule 7 — Intelligence Products Sharing
Cyber Threat Intelligence (CTI) · explicit-nameModule 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-name