Threat Actor Unknown origin

APT-C-36

Also known as: Blind Eagle

Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc.

MITRE ATT&CK TTPs 13

Remote Services

Lateral Movement

Command And Control

System Information Discovery

Command And Control

Ingress Tool Transfer

Command And Control

Modify Registry

Defense Evasion

Spearphishing Attachment

Source Articles

Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America

The threat actor Blind Eagle, also known as APT-C-36, has launched a new campaign targeting organizations in Latin America using phishing emails with judicial and administrative-themed lures in Portuguese and Spanish. These emails deliver a malicious attachment containing a weaponized SVG file that performs HTML smuggling to deploy a JavaScript dropper, which then executes a Visual Basic Script to bypass AMSI and ETW while launching an AsyncRAT-based remote access trojan. The malware establishes persistence via the Windows Startup folder, conducts environment reconnaissance, and targets sensitive data in judicial, fiscal, and educational sectors, with a focus on Colombia.

hacker-news ·21h ago