APT-C-36

Overview

APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.

Naming & attribution

APT-C-36 is tracked under 5 names across the industry. It uses 38 documented ATT&CK techniques — more than 74% of the 174 groups tracked here. Activity attributed since at least 2018.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1586.003 Cloud Accounts — used by 2 of 174 groups
• T1683.001 Written Content — used by 2 of 174 groups
• T1683.002 Audio-Visual Content — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• TA2541 — 18 shared techniques (38% overlap)
• WIRTE — 15 shared techniques (31% overlap)
• Earth Lusca China — 17 shared techniques (26% overlap)
• LazyScripter — 12 shared techniques (26% overlap)
• Gamaredon Group Russia — 21 shared techniques (24% overlap)
• FIN7 — 20 shared techniques (24% overlap)

Targets

Finance · Government · Manufacturing · Petroleum · Private sector

Regions

Chile · Colombia · Ecuador · Panama · Spain

Capabilities

• Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 38 techniques across 8 tactics

Tools & malware (9)

njRAT · Imminent Monitor · DCRAT · PureCrypter · Caminho · Remcos · AsyncRAT · QuasarRAT · HeartCrypt

Reporting (3)

• TAG-144’s Persistent Grip on South American Organizations — Insikt Group
• Blind Eagle: …And Justice for All — Check Point Research
• BlindEagle flying high in Latin America — Global Research & Analysis Team, Kaspersky