G0099: APT-C-36

APT-C-36 has acquired domains to host malicious payloads.[2][3]CitationLevelBlue Blind Eagle Proton66 JUN 2025[4][4]CitationZscaler BlindEagle DEC 2025

APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload.[1][4] APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.[3]CitationZscaler BlindEagle DEC 2025

APT-C-36 has generated email content impersonating official notifications and documents that direct victims to execute malicious payloads.[2]

APT-C-36 has used junk characters to obfuscate malicious scripts.[4]

APT-C-36 has used WMI to execute PowerShell.CitationZscaler BlindEagle DEC 2025

APT-C-36 has used a fileless attack chain composed of three JavaScript code snippets to execute subsequent payloads.CitationZscaler BlindEagle DEC 2025

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.[2]CitationLevelBlue Blind Eagle Proton66 JUN 2025[4]CitationZscaler BlindEagle DEC 2025

APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.[3]CitationLevelBlue Blind Eagle Proton66 JUN 2025[4]

APT-C-36 has used a botnet management interface to control large numbers of compromised hosts.CitationLevelBlue Blind Eagle Proton66 JUN 2025

APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.[2][3][4]CitationZscaler BlindEagle DEC 2025

APT-C-36 has disguised its scheduled tasks as those used by Google.[1]

APT-C-36 has used encoded and obfuscated files, images, and executables.[2]

APT-C-36 utilizes tools well known in crime communities and has obtained and used a modified variant of Imminent Monitor.[1][3]

APT-C-36 has customized existing malware with new capabilities including njRAT, AsyncRAT, LimeRAT, and BitRAT.[2]

APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection.[1] APT-C-36 has also compressed initial droppers into ZIP, LHA and UUE formats.[2]

APT-C-36 has disguised malicious executables to appear as legitimate files.[2]

APT-C-36 has used a compromised account to send a phishing email to an address likely used and monitored by the IT team within the same targeted organization.CitationZscaler BlindEagle DEC 2025

APT-C-36 has used malicious links in emails, often impersonating official notifications and documents, to direct users to execute malicious payloads.[2]

APT-C-36 has used phishing pages appearing like legitimate banking login portals to compromise credentials.CitationLevelBlue Blind Eagle Proton66 JUN 2025

APT-C-36 has regularly used compromised email accounts in spearphishing campaigns.[4]CitationZscaler BlindEagle DEC 2025

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.[1]

APT-C-36 has used geolocation filtering in malware delivery to redirect traffic not coming from a targeted region or country, such as Ecuador or Colombia, to legitimate sites.[2][4]

APT-C-36 has sent emails containing a link that appear to lead to an urgent notification from a government institution, at times using URL shorteners like cort[.]as, acortaurl[.]com, and gtly[.]to.[2][3][3][4]

APT-C-36 has used VPNs in their operational infrastructure.[4]

APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure.[4]

APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.[1]

APT-C-36 has staged malware implants on group-owned repositories and sites.[2]CitationLevelBlue Blind Eagle Proton66 JUN 2025

APT-C-36 has used steganography to hide malicious code, typically in the resource section of executable files.[2][4][4]CitationZscaler BlindEagle DEC 2025

APT-C-36 has used VBScript for initial malware deployment including within a malicious Word document which is executed upon the document opening.[1][2]CitationLevelBlue Blind Eagle Proton66 JUN 2025

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.[2][3]CitationLevelBlue Blind Eagle Proton66 JUN 2025[4]CitationZscaler BlindEagle DEC 2025

APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution.CitationZscaler BlindEagle DEC 2025

APT-C-36 has used port 4050 for C2 communications.[1]

APT-C-36 has used compromised Google Drive accounts including one associated with a Colombian government organization.[4]

APT-C-36 has gathered information on Colombian financial institutions, including Bancolombia, BBVA, Banco Caja Social, and Davivienda to craft phishing pages.CitationLevelBlue Blind Eagle Proton66 JUN 2025

APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway.[1][2][4][4]

APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes.[2]

APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads.[2]CitationZscaler BlindEagle DEC 2025

APT-C-36 has used side-loading to execute the HijackLoader payload.[2]